Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://www.neat-reader.com/download/start-download?target=windows

Overview

General Information

Sample URL:https://www.neat-reader.com/download/start-download?target=windows
Analysis ID:1521513
Infos:

Detection

Score:8
Range:0 - 100
Whitelisted:false
Confidence:20%

Signatures

Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Detected potential crypto function
Drops PE files
Enables security privileges
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Stores files to the Windows start menu directory
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 3572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6852 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 3640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.neat-reader.com/download/start-download?target=windows" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://play.google.com/store/apps/details?id=com.gzhi.neatreader.r2.main MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,1756451637922991175,14183001203310220918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • NeatReader Setup 8.1.4.exe (PID: 1972 cmdline: "C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe" MD5: DEF17C832C3E8169A69D3E854193F59B)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F7CE9 CryptUnprotectData,12_2_6F6F7CE9
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F7DA3 _wcsicmp,??2@YAPAXI@Z,CryptProtectData,12_2_6F6F7DA3
Source: https://www.neat-reader.com/download/start-download?target=windowsHTTP Parser: No favicon
Source: https://www.neat-reader.com/download/start-download?target=windowsHTTP Parser: No favicon
Source: https://www.neat-reader.com/download/start-download?target=windowsHTTP Parser: No favicon
Source: https://www.neat-reader.com/download/android-epub-readerHTTP Parser: No favicon
Source: https://www.neat-reader.com/HTTP Parser: No favicon
Source: https://www.neat-reader.com/HTTP Parser: No favicon
Source: https://play.google.com/store/apps/details?id=com.mobile.legends&pcampaignid=merch_published_cluster_promotion_battlestar_top_picksHTTP Parser: No favicon
Source: https://www.neat-reader.com/auto-activity?guid=83f4c120-7dc1-4372-b266-ca17c2470b3fHTTP Parser: No favicon
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\LICENSE.electron.txtJump to behavior
Source: Binary string: ffmpeg.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2911017758.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libEGL.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2911017758.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960405089.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960137150.0000000005220000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964010022.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965437167.0000000007505000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb0 source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965437167.0000000007505000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdbp" source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb@ source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960405089.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960137150.0000000005220000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964010022.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964010022.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: M.pdB source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E45000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,12_2_004059CC
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_004065FD FindFirstFileW,FindClose,12_2_004065FD
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_00402868 FindFirstFileW,12_2_00402868
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resourcesJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libsJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libs\darwinJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-listJump to behavior
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)
Source: chromecache_534.2.drString found in binary or memory: L.getElementsByTagName("iframe"),la=S.length,na=0;na<la;na++)if(!u&&c(S[na],H.Ge)){hJ("https://www.youtube.com/iframe_api");u=!0;break}})}}else F(v.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,u=!1;Z.__ytl=n;Z.__ytl.o="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_534.2.drString found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Yj:function(){e=zb()},nd:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: V8.MemoryHeapUsedV8.MemoryHeapCommitted.gmail.docs.plus.inboxcalendar.google.com.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comqq.comtwitter.comtaobao.comlive.comwikipedia equals www.youtube.com (Youtube)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1085
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1452
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1452expand_integer_pow_expressionsThe
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1512
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1637
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1936
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2046
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2152
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2152skip_vs_constant_register_zeroIn
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2273
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2514
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2517
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2727
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2978
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3016
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3027
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3045
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3153
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3205
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3243
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3246
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3246allow_clear_for_robust_resource_initSome
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3452
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3502
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3529
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3584
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3623
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3624
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3625
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3682
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3682GL_USES_FRAG_COLORGL_USES_FRAG_DATA_SECONDARY_COLORGL_USES_SECONDARGL_USES_F
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3729
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3859
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3997
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4214
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4267
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4339
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4384
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4405
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4428
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4633
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4646
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/482
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4836
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4995
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007disable_anisotropic_filteringDisable
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5055
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5061
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5281
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5469
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5535
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750ANGLE_DEFAULT_PLATFORMvulkanvulkan-nullswiftshadergld3d11GPU.ANGLE.DisplayIn
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1094869
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/110263
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1144207
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1165751
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1165751Disable
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1171371
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/308366
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/403957
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/565179
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642227
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642605
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/644669
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/650547
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/672380
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/709351
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/772651
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/797243
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/809422
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/830046
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/849576
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/883276
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/927470
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620allow_translate_uniform_block_to_structured_bufferThere
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://debuggable.com/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-ecmascript-function-objects-call-thisargument-argume
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-object.keys)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-patterns).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-template-literal-lexical-components).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-tolength).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ejohn.org/blog/javascript-micro-templating/)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965437167.0000000007300000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://feross.org
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/00e8f7a1b7603aabdb7fb3567f485cb1c2076702)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/0251b38a8405471892c5eeaba7c8d54bd7028214)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/04e07fdc620841068f12b8edf36f27e6592a0a18)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/12960c437cc25c53e682cfe5bff06d74a5bb1eb9)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/130e363856747b487652f04b5550056d7778e43a)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/132c9ee63f92a586a120ed3bd6b7ef023badb8bb)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/2180839eda2cb16edcfda46ccfe24711680af850)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/219bf22237b11bc375e2e110b93db512f1acfdd4)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/23f7f545abfe1fb6499cd61cc8ff41fd86cef4a0)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/287e589ac773d3738b2aa7d40e0b6d43dde5261b)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/2c86b10feafd868ebd071dda3a222e6f51972b5d)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/2d1c5981869e0fe6f5bc71b5c5582accfd125cc6)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/2ee32f50b88b383317e33cc0a4bfaa5f2eadead7)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/2f2078bf998bd3f44289ebd17eeccf5e12e4c134)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/325792aee92de0ba6fea306657933fc63dc00474)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/3b23865340cfba075f61f7dba0ea31fcc27260ec)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/422e539e8989e65ba43ecc39ddbaa3c4f755d465)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/48993ade9b0831fbce28d94b3b0963a4b0dccbdd)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/49642428342e5f291eb9d690802e83ed830623b5)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/4dc56f6d04e8f5fe12ba53a8a776653b3d7b60ed)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/4f968298f97394e488297ec32c8e927a3a322076)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/52a673703a87a93c0f6a8552e6bd73caba66d2eb)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/54e8fab3e3d907bbb264caf3e28a24773d0d6fdb)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/5560f729124f022ffed00085aafea43dded7fb03)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/5810f279a4caeda115f39e429c9671795613abf8)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/5afff89eca0efe7081309dc2d123309e825df221)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/62f29eb0c4dee01170a5511615e5bcc9faca26ca)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/71aaa29591d6681f8579486f18d32ba1ee651a5b)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/72f325b78edd0dc2aac940a76ce5f644005ce4c3)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/75233d974a30af6e3b8ab38a73e5ede67172fc1c)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/7e46c2058cb5994809eab5f4dbb12f21e937c72b)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/817b49830571b45a8aec6b1fc1525434f5798c58)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/88b92b43153f21609aee71d47abcd4dc27a6586d)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/8be5626bbb54e6c899a1b71d22411709126d9fea)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/9146024e1094e8bb871ab15d1b7fc556a710732f)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/99051992a9f45eb0dd79e062681d6f5d366deb41)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/9be858312553002841725b617050aaff3c48951d)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/9c5c58b18363494976185e7ddc790ac63de840ed)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/a007198fa23c19902b1f3ffb81498629e0e9c875)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/a245d18a131341feec4f87659746954e78cae780)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/acb388bc0546b48fca11dce8aa7a595af2cda5e2)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/ad91ce2346cb34e5d5a49d07dd952d15f6c832a3)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/b15115b2cbfffe15827cd5e4368267d417b72f08)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/b25e79dfb599777a38157bd419395bd28369ee86)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/b7bfa7113b8d1af49a57ab767f24a599ed92044f)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/b7fc526ea49894f366153bd32997e02568c0b8a6)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/b968688afe2c727ae141f50aa983d481dbc1dbbf)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/b9e35469d3bbd0a1ee92e0a815ce2512904d4a18)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/bc81ca9414296234c764b7306a19ba72b2e59b52)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/be7d334778481639294cdf87f5c359a230aeb65b)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/cf70dbc6d2ba62bf1eb12b563dd5ecd27af6e2be)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/d1d65dd29d7bbaf9ea42eaa5fcb0da3fb4df98e9)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/d32623baa7a6273d47be67d587ad4ea0ecffc5de)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/d48d88ee17b780c02123e6d657274cab456e943e)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/d4bdb5ed9e2fe06ec44698b66c029f624135a0ab)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/d7f7f77689e2eaef050686be2bdf3e72881a79ac)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/d9ef60398e88f2c2f958ab2b159d38052ffe7f8a)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/ef5c43bcbcf31819e032c3b7ae7654b7f8e9358b)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/f155785e2bb42b5ddf0a8156401c6dafdf57ba8b)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/f75d4455359ecdf30eeb676e2c7f31d4cf7b42ed)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/f90e825da9d505c11b4262c50cd54553f979c300)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/fc93c05f68398f30abc46fd16ae6c673a1eee099)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/koajs/koa/commit/ff70bdc75a30a37f63fc1f7d8cbae3204df3d982)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/node-modules/ylru/commit/475abb0e9c787fd65d7c3dd3d2d74d67560b0bec)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/oozcitak/xmlbuilder-js
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/qix-
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/substack/js-traverse.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/visionmedia/expresso
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://google.com
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/173636783
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://jedschmidt.com)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://jongleberry.com
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://jquery.org/license
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://jsperf.com/javascript-array-concat-vs-push/98
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ljharb.codes
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mths.be/fromcodepoint
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://n8.io/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://paul.vorba.ch
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://peter.michaux.ca/articles/lazy-function-definition-pattern)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://requirejs.org/docs/errors.html#mismatch
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/1068308/13216
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://underscorejs.org/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://underscorejs.org/LICENSE
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalidsms_fetcherBlink.Sms.Receive.TimeSmsReceiveBlink.Sms.Receive.TimeCancelOnSu
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wonko.com/post/html-escaping)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.another-d-mention.ro/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2907318497.00000000069C0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/ecma-262/7.0/#sec-function.prototype.apply).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/ecma-262/7.0/#sec-regexp.prototype.tostring
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/ecma-262/7.0/#sec-tointeger).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.whatwg.org/specs/web-apps/current-work/multipage/comms.html#crossDocumentMessages
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/watch?v=I9nDOSGfwZg
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4674
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4849
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/5140
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=2070)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=90
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=156034
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashpad.chromium.org/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashpad.chromium.org/bug/new
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1042393
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1046462
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1091824
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1137851
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/401439).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024select_view_in_geometry_shaderThe
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547call_clear_twiceUsing
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534use_system_memory_for_constant_buffersCopying
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/705865
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/710443
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/811661
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://css-tricks.com/debouncing-throttling-explained-examples/)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/extensions/sandboxingEval).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en/DOM/window.postMessage
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/17aTgLnjMXIrfjgNaTUnHQO7m3xgzHR2VXBTmi03Qii4/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://es5.github.io/#x13.2.2
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://es5.github.io/#x15.1.2.2)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/3rd-Eden/kuler
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/3rd-Eden/kuler.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/3rd-Eden/text-hex
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/3rd-Eden/text-hex.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Leonidas-from-XIV/node-xml2js
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Leonidas-from-XIV/node-xml2js.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebReflection/get-own-property-symbols/issues/4
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/YuzuJS/setImmediate#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/YuzuJS/setImmediate.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ZJONSSON/node-unzipper#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ZJONSSON/node-unzipper.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/alessioalex/tiny-each-async#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/alessioalex/tiny-each-async.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/antelle
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/antelle/node-stream-zip
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/antelle/node-stream-zip.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/antelle/node-stream-zip/blob/master/LICENSE
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bnjmnt4n/lodash-cli.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/toidentifier#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/toidentifier.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-utils/keygrip#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-utils/keygrip.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/cthackers/adm-zip
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/String.prototype.trimEnd#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/String.prototype.trimStart#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/es5-shim
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/es6-shim
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/object.getownpropertydescriptors#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/eslint/issues/6125
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/expressjs/vary)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/felixge/node-stack-trace
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/golang/go/blob/master/src/archive/zip/reader.go#L503
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/gyson/koa-convert#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/gyson/koa-convert.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/hgouveia/node-downloader-helper
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/hgouveia/node-downloader-helper.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/hgouveia/node-downloader-helper/issues)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/object-inspect
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/which-boxed-primitive#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/which-boxed-primitive.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/101)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/102)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/105)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/106
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/99)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/labels/wg-agenda
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minimatch#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/once#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/sax-js#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jashkenas/underscore/pull/1247
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jden/node-listenercount#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node/pull/7878
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-jsonfile#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery/blob/3.2.1/AUTHORS.txt
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/sizzle
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/basic-auth/issues/39
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/http-assert
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/http-errors
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/media-typer#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/media-typer.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/mime-db#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/mime-db.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/mime-types#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/mime-types.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/negotiator#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/negotiator.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/on-finished#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/on-finished.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/statuses#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/statuses.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/type-is#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/type-is.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/vary#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/vary.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/compose#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/compose.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/compose/blob/4e3e96baf58b817d71bd44a8c0d78bb42623aa95/index.js#L36
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/compose/pull/27
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/compose/pull/61
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/compose/pull/65
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/json)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koa#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koa.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koa/blob/master/docs/error-handling.md
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koa/blob/master/docs/migration.md
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koa/pull/438).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koa/pull/614
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koa/pull/668
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/koajs.com/pull/38.
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/send
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/static#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/koajs/static.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/object-keys#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/object.assign#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/object.assign/issues/17
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/unbox-primitive#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/unbox-primitive.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/util.promisify#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/util.promisify.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lodash/lodash
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lodash/lodash.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lodash/lodash/blob/4.17.15/dist/lodash.js#L6735-L6744
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/b1c8f15c5f169e021f7c46eb7b219de95fe97603/lib/util.js#L201-L230
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#L56
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/v4.4.7/lib/_http_server.js#L486
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/3043
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/3073
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/readable-stream#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/olado/doT).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/parseurl#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/parseurl.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/resolve-path#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/resolve-path.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pvorb/node-md5#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/qix-/node-simple-swizzle#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/qix-/node-simple-swizzle.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/path-is-absolute#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/path-is-absolute.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/time-zone#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/time-zone.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/js-traverse#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/minimist
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/node-hashish).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/node-mkdirp.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/suryagh/tsscmp#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/suryagh/tsscmp.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/unshiftio/one-time#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/unshiftio/one-time.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/visionmedia/node-only#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/wesleytodd/setprototypeof
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/wesleytodd/setprototypeof.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/logform#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/logform.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/triple-beam#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/triple-beam.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/winston#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/winston-transport#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/winston.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/winston/blob/2.x/lib/winston/logger.js#L198-L201
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/winston/blob/master/UPGRADE-3.0.md
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/winstonjs/winston/tree/master/UPGRADE-3.0.md
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeit/ms#readme
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeit/ms.git
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/yabPex
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://guides.github.com/activities/contributing-to-open-source/).MIT
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/infrastructure.html#space-character
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespace
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://jquery.com
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://jquery.com/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://jquery.org/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://jquery.org/license
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://js.foundation/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/custom-builds).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/icon.svg
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/license
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/ambiguous-ampersands)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-unicode).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Array/reverse).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Array/slice)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Number/isFinite).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Number/isInteger).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Number/isNaN)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Number/isSafeInteger).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Object/assign).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/String/replace).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/String/split).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/Structured_clone_algorithm)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/clearTimeout).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/isNaN)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/iteration_protocols#iterator).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/rest_parameters).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/round#Examples)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/setTimeout).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/spread_operator).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/toLowerCase).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mdn.io/toUpperCase).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://monitoring.url.loader.factory.invalid
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://monitoring.url.loader.factory.invalidPermissions
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mths.be/he).
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/http.html#http_response_writableended
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/stream.html#stream_readable_pipe_destination_options
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://npms.io/search?q=ponyfill.
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://openjsf.org/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-48
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-54
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-57
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-59
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-61
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-64
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://promisesaplus.com/#point-75
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/cthackers/adm-zip/master/LICENSE
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://registry.npmjs.org
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sizzlejs.com/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/16254385/undocumented-response-finished-in-node-js
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/encrypted-media/#direct-individualization.
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/encrypted-media/#distinctive-identifier)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/encrypted-media/#distinctive-permanent-
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5148698084376576
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5669008342777856
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5709390967472128
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5742188281462784.
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5742188281462784.CancelDeferredNavigationWillFailRequestDidComm
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromium.org/blink/origin-trials/portals
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromium.org/blink/origin-trials/portalsPrerenderHost::StartPrerenderingrender_frame_hos
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google./_/chrome/plus.google.cominbox.google.comdrive.google.comServiceWorker.DiskCache.
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/speech-api/full-duplex/v1
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/speech-api/full-duplex/v1key=pair=output=pb/down?speech_recognition_downstrea
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocatemacAddresssignalStrengthsignalToNoiseRatiowifiAcc
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/securitykey/a/google.com/origins.json
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/securitykey/origins.json
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/securitykey/origins.jsonhttps://www.gstatic.com/securitykey/a/google.com/ori
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verificati
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/babel-polyfill)
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xivilization.net
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,12_2_00405461
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965437167.0000000007300000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE memstr_1c577cd0-0
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_100010D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary,12_2_100010D0
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,12_2_0040338F
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_00406B1512_2_00406B15
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_004072EC12_2_004072EC
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_00404C9E12_2_00404C9E
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F816212_2_6F6F8162
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F856112_2_6F6F8561
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F8F7D12_2_6F6F8F7D
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F927A12_2_6F6F927A
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F137812_2_6F6F1378
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6FA83A12_2_6F6FA83A
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6F840D12_2_6F6F840D
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6FAF1C12_2_6F6FAF1C
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6FABA912_2_6F6FABA9
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F901B5F12_2_6F901B5F
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeProcess token adjusted: SecurityJump to behavior
Source: 5f76730b-09b4-44db-ab17-a9dd86f74506.tmp.0.drStatic PE information: No import functions for PE file found
Source: 684586ff-cd85-441d-9787-5fb9ae2d80f4.tmp.0.drStatic PE information: No import functions for PE file found
Source: 5f76730b-09b4-44db-ab17-a9dd86f74506.tmp.0.drStatic PE information: Data appended to the last section found
Source: 684586ff-cd85-441d-9787-5fb9ae2d80f4.tmp.0.drStatic PE information: Data appended to the last section found
Source: 5f76730b-09b4-44db-ab17-a9dd86f74506.tmp.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engineClassification label: clean8.win@33/646@0/35
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,12_2_0040338F
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,12_2_00404722
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F902AAC CreateToolhelp32Snapshot,12_2_6F902AAC
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_00402104 CoCreateInstance,12_2_00402104
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReaderJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeMutant created: \Sessions\1\BaseNamedObjects\bbff271c-caf8-5302-b3c6-6d9ee38f27e3
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Users\user\AppData\Local\Temp\nsj2B13.tmpJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965437167.0000000007505000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.neat-reader.com/download/start-download?target=windows"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://play.google.com/store/apps/details?id=com.gzhi.neatreader.r2.main
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,1756451637922991175,14183001203310220918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6852 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe "C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6852 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,1756451637922991175,14183001203310220918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Binary string: ffmpeg.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2911017758.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libEGL.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2911017758.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960405089.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960137150.0000000005220000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964010022.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965437167.0000000007505000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb0 source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965437167.0000000007505000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdbp" source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb@ source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960405089.0000000005AD0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2960137150.0000000005220000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964010022.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964010022.00000000065C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: M.pdB source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E45000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_100010D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary,12_2_100010D0
Source: 5f76730b-09b4-44db-ab17-a9dd86f74506.tmp.0.drStatic PE information: real checksum: 0x3b9af84 should be: 0xbe92
Source: libEGL.dll.12.drStatic PE information: real checksum: 0x0 should be: 0x66588
Source: libGLESv2.dll.12.drStatic PE information: real checksum: 0x0 should be: 0x2c0e87
Source: SpiderBanner.dll.12.drStatic PE information: real checksum: 0x0 should be: 0x11dab
Source: libEGL.dll0.12.drStatic PE information: real checksum: 0x0 should be: 0x604a4
Source: vk_swiftshader.dll.12.drStatic PE information: real checksum: 0x0 should be: 0x3e92d0
Source: ffmpeg.dll.12.drStatic PE information: real checksum: 0x0 should be: 0x27fa83
Source: nsis7z.dll.12.drStatic PE information: real checksum: 0x0 should be: 0x7611e
Source: libGLESv2.dll0.12.drStatic PE information: real checksum: 0x0 should be: 0x69cc7a
Source: vulkan-1.dll.12.drStatic PE information: real checksum: 0x0 should be: 0xa72ef
Source: 684586ff-cd85-441d-9787-5fb9ae2d80f4.tmp.0.drStatic PE information: real checksum: 0x3b9af84 should be: 0x3e57
Source: System.dll.12.drStatic PE information: real checksum: 0x0 should be: 0xe5c7
Source: libEGL.dll.12.drStatic PE information: section name: .00cfg
Source: libEGL.dll.12.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll.12.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll.12.drStatic PE information: section name: .voltbl
Source: vk_swiftshader.dll.12.drStatic PE information: section name: .00cfg
Source: vk_swiftshader.dll.12.drStatic PE information: section name: .voltbl
Source: vulkan-1.dll.12.drStatic PE information: section name: .00cfg
Source: vulkan-1.dll.12.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll.12.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll.12.drStatic PE information: section name: .voltbl
Source: libEGL.dll0.12.drStatic PE information: section name: .00cfg
Source: libEGL.dll0.12.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll0.12.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll0.12.drStatic PE information: section name: .voltbl
Source: NeatReader.exe.12.drStatic PE information: section name: .00cfg
Source: NeatReader.exe.12.drStatic PE information: section name: .rodata
Source: NeatReader.exe.12.drStatic PE information: section name: .voltbl
Source: NeatReader.exe.12.drStatic PE information: section name: CPADinfo
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F7038E0 push eax; ret 12_2_6F70390E
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\5f76730b-09b4-44db-ab17-a9dd86f74506.tmpJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\System.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\swiftshader\libGLESv2.dllJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe (copy)Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\Unconfirmed 708013.crdownloadJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\libEGL.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsProcess.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\NeatReader.exeJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\vulkan-1.dllJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\Unconfirmed 299717.crdownloadJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\resources\elevate.exeJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\684586ff-cd85-441d-9787-5fb9ae2d80f4.tmpJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\swiftshader\libEGL.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile created: C:\Program Files (x86)\NeatReader\LICENSE.electron.txtJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\System.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\swiftshader\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\libEGL.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\NeatReader.exeJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsProcess.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Program Files (x86)\NeatReader\swiftshader\libEGL.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,12_2_004059CC
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_004065FD FindFirstFileW,FindClose,12_2_004065FD
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_00402868 FindFirstFileW,12_2_00402868
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpackedJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resourcesJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libsJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libs\darwinJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeFile opened: C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-listJump to behavior
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.0000000006BC7000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware Virtual Webcam
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2911017758.00000000065C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tgav
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.0000000006BC7000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: eb1a:2860eb1a:28201ce6:282012ab:03801943:22530c45:64d00c45:64d21bcf:298504ca:704704ca:704804f2:b3ed04f2:b3ca05c8:035d05c8:036904ca:709513d3:52570bda:57f2VMware Virtual WebcamMedia.VideoCapture.BlacklistedDeviceGoogle Camera AdapterIP Camera [JPEG/MJPEG]CyberLink Webcam SplitterEpocCamWebcamMax../../media/capture/video/video_capture_metrics.ccDevice supports Media.VideoCapture.Device.SupportedPixelFormatMedia.VideoCapture.Device.SupportedResolution
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.0000000006BC7000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMnet
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Adreno (TM) 418Adreno (TM) 530Adreno (TM) 540GL_EXT_texture_lod_biasARB_draw_buffersGL_ARB_texture_swizzleGL_EXT_texture_swizzleGL_ARB_pixel_buffer_objectGL_EXT_pixel_buffer_objectGL_EXT_draw_buffers2GL_ARB_fragment_shaderGL_NV_texture_border_clampGL_ARB_robust_buffer_access_behaviorGL_EXT_framebuffer_sRGBGL_ARB_framebuffer_sRGBfunctions->standard == STANDARD_GL_DESKTOP && isAMDfunctions->standard == STANDARD_GL_DESKTOP && isIntelisIntel && !IsSandyBridge(device) && !IsIvyBridge(device) && !IsHaswell(device)IsApple() && isIntelisIntel && IsApple() && IsSkylake(device) && GetMacOSVersion() < OSVersion(10, 13, 2)functions->standard == STANDARD_GL_DESKTOP && (isIntel || isAMD)IsLinux() && functions->standard == STANDARD_GL_DESKTOP && isAMD(IsApple() && functions->standard == STANDARD_GL_DESKTOP) || (IsLinux() && isAMD)IsApple() && functions->standard == STANDARD_GL_DESKTOP && GetMacOSVersion() < OSVersion(10, 11, 0)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 0)IsApple() && isAMDIsAndroid() && isQualcommfunctions->standard == STANDARD_GL_DESKTOP && isNvidiaIsApple() || isNvidiafunctions->isAtMostGL(gl::Version(4, 1)) || (functions->standard == STANDARD_GL_DESKTOP && isAMD)isAMD || IsAndroid()IsAndroid() || isNvidia(IsAndroid() && isQualcomm) || (isIntel && IsApple())isAMD || isIntelIsNexus5X(vendor, device)IsAndroid() || (IsWindows() && isIntel)(IsWindows() && (isIntel || isAMD)) || (IsLinux() && isNvidia) || IsIOS() || IsAndroidEmulator(functions)IsAndroid() || limitMaxTextureSizeIsAndroid() || (IsApple() && (isIntel || isAMD || isNvidia))limitMaxTextureSizeIsApple()IsAndroid() || isAMD || !functions->hasExtension("GL_KHR_robust_buffer_access_behavior")IsApple() && isIntel && GetMacOSVersion() >= OSVersion(10, 12, 4)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 6)IsLinux() || (IsAndroid() && isNvidia) || (IsWindows() && isNvidia) || (IsApple() && functions->standard == STANDARD_GL_ES)IsApple() || (IsLinux() && isAMD)IsApple() || (IsWindows() && isAMD)functions->standard == STANDARD_GL_DESKTOP && functions->isAtLeastGL(gl::Version(3, 1)) && !functions->isAtLeastGL(gl::Version(4, 3))features->emulatePrimitiveRestartFixedIndex.enabled && IsApple() && isIntelIsApple() || IsAndroid() || IsWindows()functions->standard == STANDARD_GL_ES && functions->isAtLeastGLES(gl::Version(3, 1)) && functions->hasGLESExtension("GL_EXT_texture_norm16")IsWindows() && isAMDIsLinux() && isAMD && isMesa && mesaVersion < (std::array<int, 3>{19, 3, 5})(IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))IsApple() && functions->standard == STANDARD_GL_ES && !(isAMD && IsWindows())isDualGPUMacWithNVIDIAisTSANBuild && IsLinux() && isNvidiaIsApple() && (isAMD || isIntel || isNvidia)IsLinux() && IsWayland()!CanMapBufferForRead(functions)IsApple() && hasAMDIsAdreno42xOr3xx(func
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.0000000006BC7000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: num_failuresrelease_after_msThrottling.RequestThrottled%08x: %02x ../../net/base/network_interfaces_win.ccWlanApiwlanapi.dllWlanQueryInterfaceWlanSetInterfaceVMnetGetAdaptersAddresses failed:
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2965089648.0000000006DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2911017758.00000000065C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeAPI call chain: ExitProcess graph end nodegraph_12-8833
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeAPI call chain: ExitProcess graph end nodegraph_12-8841
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_100010D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary,12_2_100010D0
Source: NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.0000000006BC7000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ../../third_party/webrtc/modules/desktop_capture/win/window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progmanffff:%hx%n%4hx%n.
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_6F6FEB20 GetSystemTime,SystemTimeToFileTime,12_2_6F6FEB20
Source: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exeCode function: 12_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,12_2_0040338F

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
Registry Run Keys / Startup Folder		1
Access Token Manipulation		2
Masquerading		11
Input Capture		1
System Time Discovery		Remote Services11
Input Capture		2
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		2
Process Injection		1
Access Token Manipulation		LSASS Memory1
Security Software Discovery		Remote Desktop Protocol1
Archive Collected Data		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder		2
Process Injection		Security Account Manager3
Process Discovery		SMB/Windows Admin Shares1
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		1
Obfuscated Files or Information		NTDS3
File and Directory Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Software Packing		LSA Secrets4
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1521513 URL: https://www.neat-reader.com... Startdate: 28/09/2024 Architecture: WINDOWS Score: 8 5 NeatReader Setup 8.1.4.exe 134 2->5         started        8 chrome.exe 21 2->8         started        11 chrome.exe 2->11         started        13 chrome.exe 2->13         started        dnsIp3 24 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 5->24 dropped 26 C:\Users\user\AppData\Local\...\nsProcess.dll, PE32 5->26 dropped 28 C:\Users\user\AppData\Local\...\System.dll, PE32 5->28 dropped 36 13 other files (none is malicious) 5->36 dropped 40 192.168.2.5 unknown unknown 8->40 42 239.255.255.250 unknown Reserved 8->42 30 C:\Users\...\Unconfirmed 708013.crdownload, PE32 8->30 dropped 32 C:\Users\...\Unconfirmed 299717.crdownload, PE32 8->32 dropped 34 C:\...34eatReader Setup 8.1.4.exe (copy), PE32 8->34 dropped 38 2 other files (none is malicious) 8->38 dropped 15 chrome.exe 8->15         started        18 chrome.exe 8->18         started        20 chrome.exe 8->20         started        22 chrome.exe 11->22         started        file4 process5 dnsIp6 44 47.79.65.198 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ United States 15->44 46 108.177.15.84 GOOGLEUS United States 15->46 48 31 other IPs or domains 15->48

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\NeatReader\NeatReader.exe0%ReversingLabs
C:\Program Files (x86)\NeatReader\d3dcompiler_47.dll0%ReversingLabs
C:\Program Files (x86)\NeatReader\ffmpeg.dll0%ReversingLabs
C:\Program Files (x86)\NeatReader\libEGL.dll0%ReversingLabs
C:\Program Files (x86)\NeatReader\libGLESv2.dll0%ReversingLabs
C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libs\darwin\fontlist0%ReversingLabs
C:\Program Files (x86)\NeatReader\resources\elevate.exe0%ReversingLabs
C:\Program Files (x86)\NeatReader\swiftshader\libEGL.dll0%ReversingLabs
C:\Program Files (x86)\NeatReader\swiftshader\libGLESv2.dll0%ReversingLabs
C:\Program Files (x86)\NeatReader\vk_swiftshader.dll0%ReversingLabs
C:\Program Files (x86)\NeatReader\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsProcess.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsis7z.dll0%ReversingLabs
C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe (copy)0%ReversingLabs
C:\Users\user\Downloads\Unconfirmed 299717.crdownload0%ReversingLabs
C:\Users\user\Downloads\Unconfirmed 708013.crdownload0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled0%URL Reputationsafe
http://www.opensource.org/licenses/mit-license.php0%URL Reputationsafe
https://openjsf.org/0%URL Reputationsafe
https://jsperf.com/getall-vs-sizzle/20%URL Reputationsafe
http://underscorejs.org/LICENSE0%URL Reputationsafe
https://sizzlejs.com/0%URL Reputationsafe
https://npms.io/search?q=ponyfill.0%URL Reputationsafe
https://bugs.jquery.com/ticket/123590%URL Reputationsafe
https://bugs.chromium.org/p/chromium/issues/detail?id=3786070%URL Reputationsafe
https://bugs.chromium.org/p/chromium/issues/detail?id=5893470%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/antelle/node-stream-zipNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
    		unknown
    https://www.google.com/speech-api/full-duplex/v1NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
      		unknown
      https://github.com/unshiftio/one-time.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
        		unknown
        http://crbug.com/941620allow_translate_uniform_block_to_structured_bufferThereNeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
          		unknown
          https://github.com/pillarjs/resolve-path#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
            		unknown
            https://crbug.com/650547call_clear_twiceUsingNeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
              		unknown
              http://wonko.com/post/html-escaping)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                		unknown
                http://github.com/koajs/koa/commit/b968688afe2c727ae141f50aa983d481dbc1dbbf)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                  		unknown
                  https://github.com/jshttp/mime-types#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                    		unknown
                    http://anglebug.com/4633NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                      		unknown
                      http://anglebug.com/4995NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                        		unknown
                        http://github.com/koajs/koa/commit/7e46c2058cb5994809eab5f4dbb12f21e937c72b)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                          		unknown
                          https://github.com/koajs/koa/blob/master/docs/error-handling.mdNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		unknown
                            https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newNeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                              		unknown
                              https://github.com/nodejs/string_decoderNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                		unknown
                                https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabledNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://github.com/sindresorhus/path-is-absolute.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://www.ecma-international.org/ecma-262/7.0/#sec-function.prototype.apply).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://www.opensource.org/licenses/mit-license.phpNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://github.com/ZJONSSON/node-unzipper#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anonNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://crbug.com/110263NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://github.com/koajs/koa/commit/00e8f7a1b7603aabdb7fb3567f485cb1c2076702)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://mdn.io/clearTimeout).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://openjsf.org/NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://github.com/jshttp/on-finished.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://github.com/koajs/koa/commit/b7bfa7113b8d1af49a57ab767f24a599ed92044f)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://crbug.com/593024select_view_in_geometry_shaderTheNeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://html.spec.whatwg.org/multipage/infrastructure.html#space-characterNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://github.com/wesleytodd/setprototypeofNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://bugs.chromium.org/p/v8/issues/detail?id=90NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://github.com/substack/node-hashish).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://crbug.com/593024NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://github.com/koajs/koa.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://github.com/jquery/jquery/blob/3.2.1/AUTHORS.txtNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://guides.github.com/activities/contributing-to-open-source/).MITNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://jsperf.com/getall-vs-sizzle/2NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://issuetracker.google.com/161903006NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://anglebug.com/3529NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://crbug.com/710443NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://github.com/winstonjs/winston/blob/2.x/lib/winston/logger.js#L198-L201NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://underscorejs.org/LICENSENeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              http://ecma-international.org/ecma-262/7.0/#sec-ecmascript-function-objects-call-thisargument-argumeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://anglebug.com/3997NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://stackoverflow.com/a/1068308/13216NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://crbug.com/642605NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://github.com/pvorb/node-md5#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://anglebug.com/1452NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://crbug.com/1165751DisableNeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://github.com/gyson/koa-convert#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespaceNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://github.com/jshttp/media-typer.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://sizzlejs.com/NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  • URL Reputation: safe
                                                                                                  		unknown
                                                                                                  http://github.com/koajs/koa/commit/ad91ce2346cb34e5d5a49d07dd952d15f6c832a3)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://ljharb.codesNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://npms.io/search?q=ponyfill.NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://anglebug.com/3502NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://anglebug.com/3623NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://github.com/jshttp/mime-types.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://anglebug.com/3625NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://bugs.jquery.com/ticket/12359NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              • URL Reputation: safe
                                                                                                              		unknown
                                                                                                              http://anglebug.com/3624NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://peter.michaux.ca/articles/lazy-function-definition-pattern)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://github.com/RyanZim/universalify.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://anglebug.com/4836NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://issuetracker.google.com/issues/166475273NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://registry.npmjs.orgNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://github.com/3rd-Eden/text-hexNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            http://ecma-international.org/ecma-262/7.0/#sec-tolength).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://bugs.chromium.org/p/chromium/issues/detail?id=378607NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://github.com/qix-/node-simple-swizzle#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://mths.be/fromcodepointNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://github.com/lodash/lodash/blob/4.17.15/dist/lodash.js#L6735-L6744NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmp, NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906478813.0000000004E7A000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://github.com/crypto-utils/keygrip#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://anglebug.com/3970NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://github.com/3rd-Eden/kulerNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://mdn.io/Number/isFinite).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://github.com/koajs/koa/pull/614NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://github.com/jshttp/on-finished#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://lodash.com/custom-builds).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://github.com/koajs/koa/commit/a007198fa23c19902b1f3ffb81498629e0e9c875)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://github.com/jquery/jquery.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://anglebug.com/3859NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://github.com/jshttp/http-assertNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://github.com/jshttp/negotiator.gitNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            http://github.com/koajs/koa/commit/54e8fab3e3d907bbb264caf3e28a24773d0d6fdb)NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://bugs.chromium.org/p/chromium/issues/detail?id=589347NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              • URL Reputation: safe
                                                                                                                                                              		unknown
                                                                                                                                                              https://mdn.io/spread_operator).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://github.com/winstonjs/logform#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://anglebug.com/2514NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://github.com/alessioalex/tiny-each-async#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://anglebug.com/3729NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://crbug.com/830046NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://github.com/es-shims/String.prototype.trimStart#readmeNeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://anglebug.com/2517NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://github.com/eslint/eslint/issues/3229NeatReader Setup 8.1.4.exe, 0000000C.00000003.2906837489.00000000056D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://anglebug.com/4937NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://issuetracker.google.com/166809097NeatReader Setup 8.1.4.exe, 0000000C.00000003.2913935462.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://crbug.com/401439).NeatReader Setup 8.1.4.exe, 0000000C.00000003.2964415087.00000000069C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown

                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                      Public IPs

                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                      142.250.186.46
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.206
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      74.125.133.155
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      47.79.65.198
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		9500VODAFONE-TRANSIT-ASVodafoneNZLtdNZfalse
                                                                                                                                                                                      172.217.16.214
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.206.72
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.186.174
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.168
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.239.38.181
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.206.54
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.227
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.181.238
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.162
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.186.131
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      172.217.18.10
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.186.136
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.184.195
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.67
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.186.78
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      1.1.1.1
                                                                                                                                                                                      		unknownAustralia
                                                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                      108.177.15.84
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.186.163
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      172.217.18.3
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.132
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.206.86
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.136
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      172.217.18.2
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.206.46
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.181.246
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      239.255.255.250
                                                                                                                                                                                      		unknownReserved
                                                                                                                                                                                      		unknownunknownfalse
                                                                                                                                                                                      47.254.121.20
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		45102CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdCfalse
                                                                                                                                                                                      142.250.186.164
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.212.161
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      172.217.16.195
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse

                                                                                                                                                                                      Private

                                                                                                                                                                                      IP
                                                                                                                                                                                      192.168.2.5

                                                                                                                                                                                      General Information

                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                      Analysis ID:1521513
                                                                                                                                                                                      Start date and time:2024-09-28 20:02:40 +02:00
                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                      Overall analysis duration:0h 6m 38s
                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                      Report type:full
                                                                                                                                                                                      Cookbook file name:browseurl.jbs
                                                                                                                                                                                      Sample URL:https://www.neat-reader.com/download/start-download?target=windows
                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                      Number of analysed new started processes analysed:13
                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                      Technologies:
                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                      Detection:CLEAN
                                                                                                                                                                                      Classification:clean8.win@33/646@0/35
                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                      • Number of executed functions: 53
                                                                                                                                                                                      • Number of non-executed functions: 137
                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                      • Browse: https://neat-reader-release.oss-cn-hongkong.aliyuncs.com/NeatReader%20Setup%208.1.4.exe
                                                                                                                                                                                      • Browse: https://www.neat-reader.com/download/android-epub-reader
                                                                                                                                                                                      • Browse: https://www.neat-reader.com/auto-activity?guid=83f4c120-7dc1-4372-b266-ca17c2470b3f

                                                                                                                                                                                      Warnings

                                                                                                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                      • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                      • VT rate limit hit for: https://www.neat-reader.com/download/start-download?target=windows

                                                                                                                                                                                      Simulations

                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                      14:04:59API Interceptor11x Sleep call for process: NeatReader Setup 8.1.4.exe modified

                                                                                                                                                                                      QR Codes

                                                                                                                                                                                      SourceURL
                                                                                                                                                                                      Screenshothttps://play.google.com/store/apps/details?id=com.gzhi.neatreader.r2.main

                                                                                                                                                                                      LLM Input / Output

                                                                                                                                                                                      InputOutput
                                                                                                                                                                                      URL: https://www.neat-reader.com/download/start-download?target=windows Model: jbxai
                                                                                                                                                                                      {
"brand":["Neat Reader"],
"contains_trigger_text":true,
"trigger_text":"Download will start in 1s",
"prominent_button_name":"Sign in",
"text_input_field_labels":["Android",
"iOS"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":true,
"has_visible_qrcode":false}
                                                                                                                                                                                      URL: https://www.neat-reader.com/download/start-download?target=windows Model: jbxai
                                                                                                                                                                                      {
"brand":["Neat Reader"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"Sign up now",
"text_input_field_labels":["Sign in",
"Sign in with Google",
"Sign in with Apple",
"Phone",
"email",
"username",
"Forgot password?",
"Dont have an account?"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                                                                                                                                                                      URL: https://www.neat-reader.com/download/start-download?target=windows Model: jbxai
                                                                                                                                                                                      {
"brand":["Neat Reader"],
"contains_trigger_text":false,
"trigger_text":null,
"prominent_button_name":"Sign in",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                                                                                                                                                                      URL: https://www.neat-reader.com/download/start-download?target=windows Model: jbxai
                                                                                                                                                                                      {
"phishing_score":2,
"brands":"Neat Reader",
"legit_domain":"neat-reader.com",
"classification":"unknown",
"reasons":["The brand 'Neat Reader' is not widely recognized and falls under the 'unknown' category.",
"The URL 'neat-reader.com' matches the brand name 'Neat Reader' without any suspicious elements such as misspellings,
 extra characters,
 or unusual domain extensions.",
"The input fields provided (Sign in,
 Sign in with Google,
 Sign in with Apple,
 Phone,
 email,
 username,
 Forgot password?,
 Don't have an account?) are typical for a legitimate login page."],
"brand_matches":[true],
"url_match":true,
"brand_input":"Neat Reader",
"input_fields":"Sign in,
 Sign in with Google,
 Sign in with Apple,
 Phone,
 email,
 username,
 Forgot password?,
 Dont have an account?"}
                                                                                                                                                                                      URL: https://www.neat-reader.com/download/android-epub-reader Model: jbxai
                                                                                                                                                                                      {
"brand":["Google Play"],
"contains_trigger_text":true,
"trigger_text":"For Android 5.0 and above",
"prominent_button_name":"Introduction",
"text_input_field_labels":["Support all your devices",
"Manage your books",
"Perfectly Display"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":true}
                                                                                                                                                                                      URL: https://play.google.com/store/games Model: jbxai
                                                                                                                                                                                      {
"brand":["Google Play Games"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":["Google Play Games on PC"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                                                                                                                                                                      URL: https://play.google.com/store/apps/details?id=com.gzhi.neatreader.r2.main Model: jbxai
                                                                                                                                                                                      {
"brand":["Google Play"],
"contains_trigger_text":true,
"trigger_text":"Sign into X Sign in with Google Sign in with Apple Phone,
 email,
 or username Forgot password?  Dont have an account? Sign up",
"prominent_button_name":"Install",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":true,
"has_visible_qrcode":false}
                                                                                                                                                                                      URL: https://play.google.com/store/games Model: jbxai
                                                                                                                                                                                      {
"brand":["Google Play Games on PC"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                                                                                                                                                                      URL: https://www.neat-reader.com/auto-activity?guid=83f4c120-7dc1-4372-b266-ca17c2470b3f Model: jbxai
                                                                                                                                                                                      {
"brand":["Neat Reader"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"Go Premium",
"text_input_field_labels":["Select Plan",
"Checkout",
"Success"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                      IPs

                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                      Domains

                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                      ASNs

                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\LICENSE.electron.txt

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1096
                                                                                                                                                                                      Entropy (8bit):5.13006727705212
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                      MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                      SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                      SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                      SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\LICENSES.chromium.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5370001
                                                                                                                                                                                      Entropy (8bit):4.849557721751705
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
                                                                                                                                                                                      MD5:6B84319EE8A0A0AF690273D3D2DCBAF4
                                                                                                                                                                                      SHA1:857CA353E0582D100DCBC6CB6761BB4430D0CB90
                                                                                                                                                                                      SHA-256:FC2A256467FB4D4FF72BE6C423E5961E98B418554DEEEC296ADED0E757B9A585
                                                                                                                                                                                      SHA-512:26F9842BFDB429EF132CC1A930DA9187071A339927EDA402E8D54B5EB9E03067612CDADC3A2DAD3D0977F8E6AF18C05EAB6AC91720221C6A0104F96638F85A8A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview: Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<style>..html {.. --google-blue-50: rgb(232, 240, 254);.. --google-blue-300: rgb(138, 180, 248);.. --google-blue-600: rgb(26, 115, 232);.. --google-blue-900: rgb(23, 78, 166);.. --google-grey-200: rgb(232, 234, 237);.. --google-grey-800: rgb(60, 64, 67);.. --google-grey-900: rgb(32, 33, 36);.... --interactive-color: var(--google-blue-600);.. --primary-color: var(--google-grey-900);.... --product-background: var(--google-blue-50);.. --product-text-color: var(--google-blue-900);.... background: white;..}....@media (prefers-color-scheme: dark) {.. html {.. --interactive-color: var(--google-blue-300);.. --primary-color: var(--google-grey-200);.... --product-background: v

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\NeatReader.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):117631920
                                                                                                                                                                                      Entropy (8bit):6.979731352768833
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1572864:7iJCno+qBonCy35Nq2ev+NfglaPGBiUth2c/o/MH9GfHUcFAhsGkXq4fMZc6hECp:dno+qmF+mc/o/IwBokDz6FrMI
                                                                                                                                                                                      MD5:C64AD6EB36F7AF719A1DA46A9DAEEC8A
                                                                                                                                                                                      SHA1:668DE973487E499BD72A05485656DC8F83A57A9F
                                                                                                                                                                                      SHA-256:A85F3A4C5D78D721AC164D7FC1EFED562638EB4E0C55FF7D0C8CF3971C896F48
                                                                                                                                                                                      SHA-512:F9B71CAB94DA9226F7DBC093E9C680A2CC34FDC69042CB7A880E45C2D846455DEF74A819B5749CBD28A2C212B94235888CF3D02E7862BF32D8BE1215F29DDF9C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."...........K.....@6............@..........................`;....."u....@.................................)...h........................I......../.|;.......................7.....................\...........`....................text...Z........................... ..`.rdata.............................@..@.data.....=..`.......P..............@....00cfg..............................@..@.rodata.`........................... ..`.tls....)............"..............@....voltbl.y............$..................CPADinfo(............&..............@....rsrc................(..............@..@.reloc..../......./.................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\chrome_100_percent.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):141525
                                                                                                                                                                                      Entropy (8bit):7.919777817493783
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:igKzw9bpyZFM5fgm32Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:nKzw9ozA4m3m8Gb0OV8ld0GecQ3mExhk
                                                                                                                                                                                      MD5:03AAA4F8525BA4B3E30D2A02CB40AB7A
                                                                                                                                                                                      SHA1:DD9AE5F8B56D317C71D0A0A738F5D4A320A02085
                                                                                                                                                                                      SHA-256:C3F131FAEEFAB4F506BF61C4B7752A6481F320429731D758EF5413A2F71441F7
                                                                                                                                                                                      SHA-512:C89A1B89B669602BA7C8BF2C004755CAC7320189603FECB4F4C5CF7A36DB72DA651C7B613607146F0C6DA9EEC5DF412C7FBA75475352192351C02AEBDAA7D9A9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:..................#.N...:......T.....T.....T.....T.....T1....T.... T....!T...."T....#T....$T/...+T."..,TM$../T.%..0T:'..7T.'..8T31..9Ta9..:T.;..;T)<...^.=...^8>...^.?...^.B...^.E...^.I...^.M...^.P...^.T..V^WX..W^.Y..X^.[..Y^p\..Z^c]..[^.^..`^.^..a^L...b^....2n~...3n....4n....5n....6n....7n....8n}...:n)...<nb...=n9...>n....?n....@n....An....Bn&...Cn....En....Fn....Hn....In....Kn.)..Ln.3..Rn.7..Sn.9..Tn]B..Un.J..Vn.K..Wn3M..Xn.O..Yn:R..[n.R..]n.U..^n.X.._n.Y..`n.[..an.]..bn.^..cn.`..dn.a..fn.d..gnlf..in.i..jn,k..ln.n..mn.q..rn.s..tnb...un....vn....wn....xn...yn....zn,...{n....|n2...}n....~n....n.....n.....n.....n.....nY....n....n.....n.....nd....n9....n.....n....n.....n.....ne....n<....n.....n.....n.....n\....n#....n.....n.....n.....n.....nV....n.....n8....n.....n.....n.....n.....ng....n0....n.....n.....na....n&....n.....n.....n.....n.....n.....n.....p.....p.....p0....p.....p%....pO....p.....pf....p.....p.....pT....p.....p.....p.....p.....p.....p.....p.....p2....p.....pK....p.....p(.

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\chrome_200_percent.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206981
                                                                                                                                                                                      Entropy (8bit):7.946665927992836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:TDQYaF+9b7zA4m0k5GMRejnbdZnVE6Yopym74:gfs7T6edhVELo374
                                                                                                                                                                                      MD5:7D4F330A5443EADF32E041C63E7E70AD
                                                                                                                                                                                      SHA1:26CE6FB98C0F28F508D7B88CF94A442B81E80C88
                                                                                                                                                                                      SHA-256:B8704BE578E7396EE3F2188D0C87D0EDE5C5702E9BB8C841B5F8D458ABF1356D
                                                                                                                                                                                      SHA-512:F1B9B0DD7396863AA0FECA06175B7F9EA0BE4122351ECF0A0549EE4C34F85AC8C63CC927D7409A40B6E19FA91D2CB00A145616BA19F47045B2345BFBC2D4802D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:..................#.O...:......Tz....T.....Tm....T2....Tp....Tk... T)&..!Te+.."Tu...#T.5..$T":..+TyB..,T.D../T_F..0T.I..7TYJ..8T.^..9T.p..:T'v..;T.v...^#x...^.|...^8....^,....^1....^p....^.....^c....^....V^...W^....X^....Y^....Z^....[^....`^<...a^....b^=...2n....3n....4n....5n....6nB...7n{...8n....:n....<n.&..=n.-..>n73..?n.8..@n.?..AnWA..Bn.E..Cn.I..EnsS..Fn.V..Hn._..In.b..Kn.l..Ln.v..Rn*{..Sn.|..Tn....Un*...Vn....Wn....Xn*...Yn?...[nW...]nr...^n?..._n....`n....an=...bn;...cn(...dnI...fn:...gnb...in_...jn}...ln....mn2...rn....tn....un....vn....wnr...xn....yn....zn....{n....|n....}n....~n. ...n."...n.#...n_%...n.'...n.,...n.1...nv9...nWA...n.B...n.D...npE...n.F...n,H...n.I...nKM...n-Q...n.T...nGV...n.W...n.Y...n%....nu....n.....n.....n.....n.....n.....n.....n.....n.....n]....n#....n.....n.....n.....n(....nI....n=....n3....nV....nz....n.....n.....nc....n.....n.....n.....p.....p.....p:....p.....pG....p}....pV....p.....p.....pj....p.....p.....p2....p(....p.....p@....p.....pe....p.....p..

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\d3dcompiler_47.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3714200
                                                                                                                                                                                      Entropy (8bit):6.570736584573205
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:sXMoHAsisjBFjJMLhHELxJm8ZU8W/GBj5Z535TMpinAizxkl/cD11bqCG7jHbOkD:srZOb8W/G5hnAizxz7NZy9AG
                                                                                                                                                                                      MD5:2F2E363C9A9BAA0A9626DB374CC4E8A4
                                                                                                                                                                                      SHA1:17F405E81E5FCE4C5A02CA049F7BD48B31674C8F
                                                                                                                                                                                      SHA-256:2630F4188BD2EA5451CA61D83869BF7068A4F0440401C949A9FEB9FB476E15DF
                                                                                                                                                                                      SHA-512:E668A5D1F5E6F821EBFA0913E201F0DFD8DA2F96605701F8DB18D14EA4FDEAC73AEB9B4FE1F22EAEFFCDD1C0F73A6701763727D5B09775666F82B678404E4924
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................s.....s.............G......./..................................)......+..........Rich...................PE..L..................!.....*6.........P.*......@6..............................@9.......9...@A.........................46.u...X37......P7.@.............8.."...`7.,.......T...................l...........@............07.T............................text...e(6......*6................. ..`.data...h....@6..d....6.............@....idata.......07.......6.............@..@.rsrc...@....P7.......6.............@..@.reloc..,....`7.......6.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\ffmpeg.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2584064
                                                                                                                                                                                      Entropy (8bit):6.867373949563202
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:JbW/NuM92guiyeJNQltLHLS/vGPJHbDG7SW:tWFuM92gu/ZHLScRDM
                                                                                                                                                                                      MD5:94BD681436FF248B03114C9A1FF48B09
                                                                                                                                                                                      SHA1:F1928DA886448559F57194ADBFA940130AC10A31
                                                                                                                                                                                      SHA-256:9F33C5FFF122D95AB6B8F956158F93804E80E8EB27B38F2948623EBC748ED8D9
                                                                                                                                                                                      SHA-512:22C8DF6ACA587CBD6006FF7650C6A84777A0D4A423DDF390F7B1885C2D1FDC1CBEEA79A47DCFEE29DC443ADA91612B31E629AB41378A556DACD6815075D042F3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."!...... ..J...............................................`9...........@A.........................K&......Q&.(.............................8.......&.......................&......O .............DS&..............................text...e. ....... ................. ..`.rdata...M...0 ..N..." .............@..@.data...`.....&..*...p&.............@....00cfg.......`8.......&.............@..@.tls.........p8.......&.............@....voltbl.......8.......&..................reloc........8.......&.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\icudtl.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):10413488
                                                                                                                                                                                      Entropy (8bit):6.281507508108464
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:196608:+UGwSv9AAQnt6liXUxR0rHa93WhlU6tcCLhl:+oKlQnAliXUxR0rHa93WhlU6t3Ln
                                                                                                                                                                                      MD5:80A7528515595D8B0BF99A477A7EFF0D
                                                                                                                                                                                      SHA1:FDE9A195FC5A6A23EC82B8594F958CFCF3159437
                                                                                                                                                                                      SHA-256:6E0B6B0D9E14C905F2278DBF25B7BB58CC0622B7680E3B6FF617A1D42348736B
                                                                                                                                                                                      SHA-512:C8DF47A00F7B2472D272A26B3600B7E82BE7CA22526D6453901FF06370B3ABB66328655868DB9D4E0A11DCBA02E3788CC4883261FD9A7D3E521577DDE1B88459
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .5....A.......A..P....A.......A.. ....A..p....B.......B..0&..(B...&..8B...&..HB.. n..\B..pn..oB..`o...B...o...B.. p...B...q...B..0r...B...r...B...r...B...s...C...t...C.. v..-C...v..@C...w..SC..px..fC..0y..yC...{...C...|...C.. }...C..`~...C...~...C.......C.......C..p....D.....$D......7D..p...JD.. ...]D......nD......D.. ....D..p....D.......D.......D..0....D.......D......E.. ..."E..p...3E......GE......WE......jE..`....E.......E.......E.......E..`....E.......E.......E.......F..`0..0F....&.GF....&.^F..P.&.uF..@.&..F....&..F....&..F....&..F..p.&..F....&..G...W(.'G..P#).@G..`.)._G....)..G.. B*..G....*..G..p.*..G..`.+..G..0.+..H....+.)H....+.BH...W+.^H.. .+.|H....-..H....-..H....-..H....-..H..P.-..H....-..I.......I......-I..`...EI......UI...8..hI...9..{I..P9...I...9...I...9...I..P:...I...:...I...;...I...]...J..._...J.. ...2J..p...GJ..P...\J..`./.qJ..

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\libEGL.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):354816
                                                                                                                                                                                      Entropy (8bit):6.5791835920022566
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:8z/HOSsej/GoilKtpeTJztCwdm6EhVRuGZ4uVPZrdzVpTAGW1cSAiXcI:b7lKtpDwdm6EwVuVPDz/vAF
                                                                                                                                                                                      MD5:A18F9DBFF39676B0DFA86F66B768C45A
                                                                                                                                                                                      SHA1:D2726EF6F61C8008738438D931C676812E14124B
                                                                                                                                                                                      SHA-256:A58F172C9C9984EB651AD4C5B870EF21D508AE9284ED1B4B81CD15D5AC2843FC
                                                                                                                                                                                      SHA-512:8C3A71D9C69EA230A1A0A5133801E6D4BE9116FD0D8A0503A218704318FD4A8CE29EC0F8781F7180D1DFCD8010DFC223C56E5F2AF3583F04FA465246C84BD89D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."!.........V.......O....................................................@A........................\...........(.......x........................5..................................P0..................d............................text...Q........................... ..`.rdata....... ......................@..@.data....3... ......................@....00cfg.......`.......(..............@..@.tls.........p.......*..............@....voltbl..............,...................rsrc...x...........................@..@.reloc...5.......6...4..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\libGLESv2.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6924288
                                                                                                                                                                                      Entropy (8bit):6.78607570697073
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:98304:zQC8egWG0K9+suw5CCVwAuD5lTsnCir1l5V/jAPS+DrvPC8z:zQC8eTGsw5JwAull27borH
                                                                                                                                                                                      MD5:EA0386C952F7896CF0D1B275B4A23EE6
                                                                                                                                                                                      SHA1:2E853ADFBBB4097898B64C9850751B0B41B990BE
                                                                                                                                                                                      SHA-256:D428852CD603A7C83B214005DBF4FAAB3751D15FC37FB1DCC75F8247E8001973
                                                                                                                                                                                      SHA-512:ABD6ED5E62EAA47E2860709CF067A1A9DD4F9C8108FA34B419B72C7F4F6B2C88624645B4A7FF9EA3B42D3647268D583AA9651DE38DBDFB6DD977E29FB3CA1323
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."!.....rN..0........E...................................................@A........................-.a.......c.d....P.......................`......<.a.....................@.a.......N...............c.T...d.a.@....................text....qN......rN................. ..`.rdata..d4....N..6...vN.............@..@.data....P3...c..\....c.............@....00cfg....... ........f.............@..@.tls.........0........f.............@....voltbl......@........f..................rsrc........P........f.............@..@.reloc.......`........f.............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\am.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154369
                                                                                                                                                                                      Entropy (8bit):5.008301713077239
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:nJ1NSM/92t7Rh4rgEkDvuHq/VoZLokijEG/yZJjh6oVjUWRSuo90kef97ZVt1nnu:nzym+u9QfCx30jH8+x
                                                                                                                                                                                      MD5:5C617F3833923FCA5717A549FA57ADCA
                                                                                                                                                                                      SHA1:0102AC3C8041FAB6A1A65A3BCAF7E79C0B7FD719
                                                                                                                                                                                      SHA-256:5F323C0BD185D5BD5F7EA737018F14FD6EA500BA5440BC74F5C09B635518EADC
                                                                                                                                                                                      SHA-512:87034E798355875F3459567ED1F11E5455FC5ADC9634EEC33E9DB2446451FEBF7F35F617709A9B09BF3BC52F195EDEA0CB47D474D2C11CA93A8B5383142D45E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.f4..k.u4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5.... 5....%5....-5....55....=5....D5....K5....R5....S5....T5.....5.....5.....5.....5.....6.....6.....6.....6...."6....>6....p6.....6.....6.....6.....6.....6.....6.....6.....7.....7....$7....+7....B7....N7....[7....}7..*..7..+..7..,..7../..7..0..7..1.88..2.T8..3.d8..4..8..5..8..6.69..7.^9..>..9..?..9..N..9..g..9..i..9..j..9..k..9..l..9...I.9...I.:...I3;...I<;...J{;...J.;...J.;...J.;...J.;...J.;...J.<...J#<...J|<...J.<...J.<...J.<...J.<...J.=.. J.=..!J.=.."J.=..#J.=..$J.=..%J(>..&J.>..'J??..)J.?..*J.@..+JL@..,Jb@../J.@..0JlA..1J|B..2J.B..3J.B..5J+C..6J.C..7J.D..8J.D..9J.E..:J@E..;J_G..<J|H..=JWI..>J.I..@J.J..BJ.J..CJ4J..DJGJ..EJ`J..FJ.J..KJ2K..LJsK..MJ*L..NJFL..OJrL..PJ.L..QJ-M..RJ.M..SJ.N..TJXN..WJ.O..ZJUO..\JdO..]JjO..^JsO.._J.O..`J.O..aJ.O..bJ.O..cJ.P..dJ.P..eJGP..fJxP..gJ.P..hJ.Q..iJYQ..kJrQ..mJ.Q..nJ.Q..oJ.Q..pJ.Q..qJzR..tJqU..wJ.U..xJ.U..yJ.V..zJ#V..{JSV..}JwV...J.V...J.W...J|W

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ar.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156996
                                                                                                                                                                                      Entropy (8bit):5.084198860333123
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:91mmOGHNSNRZaJTGxRh+7iMuxHSM2uZtE9yKBZ1F/R2bKSI1+/BI1Iir2L2p:zjOlNRQs+7i0g/BI1Zp
                                                                                                                                                                                      MD5:8F9C8DD93B03202220B5E226C6956025
                                                                                                                                                                                      SHA1:8290DBA9B8DCC89928821EAD04F7CF599C0BA557
                                                                                                                                                                                      SHA-256:E7F9A474399C0CA0DAF28C6153F6EC7AE87423E66C8FFE0849407471D20B6237
                                                                                                                                                                                      SHA-512:3EB0B80CC7243ED646CFC7BE31EB27F0AA15F2AA8A5D2C50C3E5EFD8A81759637E3F986C5C294262FF3BC94A939BB3803268B4EDA46B3CFE224F596BFB4ED00A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.Z4..k.i4..l.t4..n.|4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..5.....5.....5....!5....)5....15....85....?5....F5....H5.....5.....5.....5.....5....'6....*6.....6....86....X6....x6.....6.....6.....6.....6.....6.....6.....6.....6.....7.....7.....7....17....97....L7....n7..*..7..+..7..,..7../..7..0..7..1..8..2..8..3.08..4.W8..5.~8..6..8..7..9..>.79..?.B9..N.]9..g.k9..i.n9..j.r9..k.w9..l..9...I.9...I.9...I.:...I.:...J#;...J+;...J<;...JO;...Js;...J.;...J.;...J.;...J.<...J.<...J=<...JC<...Jh<...J}<.. J.<..!J"=.."J<=..#JW=..$J[=..%J}=..&J.=..'JP>..(J.>..)J.?..*J.?..+J.?..,J.@../JG@..0J.@..1J.A..2J.B..3J1B..5JpB..6J.C..7J.D..8J.D..9J.D..:J!E..;J>I..<J.K..=J.L..>J.M..@JRM..BJ\M..CJsM..DJ.M..EJ.M..FJ.M..KJ.N..LJ.N..MJmO..NJ.O..OJ.O..PJ(P..QJ.P..RJ5Q..SJ.Q..TJ.R..WJ.S..ZJmS..[J{S..\J.S..]J.S..^J.S.._J.S..`J.S..aJ.T..bJ.T..cJ.T..dJNT..eJ.T..fJ.T..gJXU..hJwU..iJ.U..kJ.U..mJ.U..nJ.U..oJ.V..pJ=V..qJBW..tJB_..wJ._..xJ._..zJ._..{J.`..}J>`...JS`...J.`...JDa...J.a

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\bg.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170110
                                                                                                                                                                                      Entropy (8bit):4.813810055718465
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:P3504qAG1u0PSFq8HyyW4nSpbBqjnUmIKW3RZzrzCLy8Asgiamd3vNgT72eM+sUS:P35vqpTPaTo4njmZzrmLy8ADINW72eMz
                                                                                                                                                                                      MD5:00D012A55A50BBA5DE8B2FC2E0D163B2
                                                                                                                                                                                      SHA1:89163FA9905876167A0C7D3446BCB0BD30F88EF4
                                                                                                                                                                                      SHA-256:BD3A3AACC3CEE9864404755EEE9542E0F21EFBEBD4A71E5333D15783D4CE18C9
                                                                                                                                                                                      SHA-512:3BD6C774729F3531D316917DEB7D8FE977C5BF5A3E85846F061C4AF5FB6C45F79D8A3557A47D4569AD52819B3CCAB13D386A9F5C1801E25E969E194A956D40A2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........(...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|."5..}.45....<5....A5....I5....Q5....Y5....`5....g5....n5....o5....p5.....5.....5.....5.....6....96....;6....?6....K6....^6....y6.....6.....6.....7....77....>7....A7....B7....V7....l7.....7.....7.....7.....7.....7.....7.....8..*.)8..+.,8..,.J8../..8..0..8..1..9..2.+9..3.N9..4..9..5..9..6.8:..7.\:..>..:..?..:..N..:..g..:..i..:..j..:..k..:..l..:...I.:...I1;...I.<...I.<...J.<...J.<...J.=...J!=...JW=...J.=...J.=...J.>...J >...JF>...JX>...J.>...J.>.. J(?..!Jo?.."J.?..#J.?..$J.?..%J.@..&JT@..'J0A..(J.A..)J.B..*J.B..+J.C..,J7C../JhC..0JSD..1J.E..2J.E..3J.E..5J7F..6J.G..7J.G..8J.G..9J.G..:J!H..;J.I..<J.J..=JXK..>J.K..@J.L..BJ.L..CJ.L..DJ@L..EJhL..FJ.L..KJ]M..LJ.M..MJqN..NJ.N..OJ.N..PJ1O..QJ.O..RJrP..SJ.Q..TJ^Q..WJ.R..ZJ.R..\J.R..]J.S..^J.S.._J?S..`JjS..aJ.S..bJ.S..cJ.S..dJ.S..eJ6T..fJlT..gJ.T..hJ.U..iJ^U..kJkU..mJ.U..nJ.U..oJ.U..pJ.V..qJ.V..tJ>Y..wJ.Y..xJ.Y..yJ)Z..zJ7Z..{JKZ..}J}Z...J.Z...Jt[...J.[

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\bn.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):221799
                                                                                                                                                                                      Entropy (8bit):4.419808794496792
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:fPjRXprzuB7CPIqPp2nKEZ3UzKoZ4CfrNuduY0Jri0CI58JRKgqZBiCYWY0PnxRB:fbbNp2KGCDjr58JMgqbxRRImv7hfUHm/
                                                                                                                                                                                      MD5:80C804A82C617E7E0FC1E7F0DF63290C
                                                                                                                                                                                      SHA1:A81F3AC6E92785E4C96E7DBD01FCA8BFD446071A
                                                                                                                                                                                      SHA-256:B4ED891E8B38452623348DA12D325B52407446114CBA664A8E25A26A7CFAF773
                                                                                                                                                                                      SHA-512:919856917F185DCAA6204A0B990E49498EF59B72CF93F8B6DA44785F4E889B70C0B05300AC15009260DDB36A8D4F06FEE5D8C4796E60A43C2957EA436F7316BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.j4..k.y4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5....%5....*5....25....:5....?5....G5....N5....U5....\5....]5....^5.....5.....6....=6....h6.....6.....6.....6.....6.....6.....7....A7....o7.....7.....7.....7.....7.....7.....7.....8.....8....28....S8....b8....z8.....8..*..8..,..8../..9..0..9..1..9..2..9..3..9..4..:..5.x:..6..:..7.4;..>..;..?..;..N..;..g..;..i..;..j..;..k..;..l..<...I.<...I]<...I=>...IY>...J.>...J.>...J.>...J.>...J/?...JK?...J}?...J.?...J.@...J'@...JR@...Jh@...J.@...J.@.. JdA..!J.A.."J.A..#J.B..$J2B..%J.B..&J.B..'J0D..(J7E..)JAF..*JlF..+J.F..,J.F../JDG..0J.H..1J.J..2J.J..3J.J..5JqK..6J.L..7J.M..8J.N..9J,N..:J.N..;J.Q..<J.S..=J.T..>J.U..@J.U..BJ.U..CJ.V..DJ'V..EJVV..FJ.V..KJ.W..LJ)X..MJ3Y..NJPY..OJ.Y..PJ.Y..QJ.Z..RJJ[..SJ.\..TJh\..WJ.]..ZJ<^..[JX^..\Jt^..]J}^..^J.^.._J.^..`J._..aJb_..bJc_..cJ._..dJ._..eJ.`..fJ?`..gJ.`..hJ.a..iJEa..kJXa..mJ.a..nJ.a..oJ.a..pJQb..qJSc..tJ.h..wJ.h..xJ.i..yJsi..zJ.i..{J.i..}J.j...J/j...J6k

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ca.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):108499
                                                                                                                                                                                      Entropy (8bit):5.413075728378605
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:Em2DPcgrI54tBL8l/oq7O5awat8PU02he8X/FS0bzRhqRRhnAkpxlCEtT3nRA39u:EvPcgkoqO5a78PUzhe8X/80nEznAkpxl
                                                                                                                                                                                      MD5:79EC325651589F138C7840C61316D8F5
                                                                                                                                                                                      SHA1:37503EDCAE710E2D61F390064FA2D9893D4B9C8D
                                                                                                                                                                                      SHA-256:9A4E286A58BB9A58E9E30D982783663C9BCE40730CB6DAD4C37980038040919E
                                                                                                                                                                                      SHA-512:F00A9354871C77947D2B99E83B54BABCB46B5A45C24702C1B5F750156ABCB2A00D12C6B4C2E15634D4D560DE0AFA5B9C368D31F08CF447F2209F51C0B8EF6384
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........&...j.~4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|..5..}.05....85....=5....E5....M5....U5....\5....c5....j5....k5....l5.....5.....5.....5.....5.....6.....6.....6.....6.... 6....06....F6....]6....r6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6..*..7..+..7..,.!7../.K7..0.P7..1..7..2..7..3..7..4..7..5..7..6..8..7.08..>.D8..?.N8..N.a8..g.n8..i.q8..j.u8..k.z8..l..8...I.8...I.8...I.9...I.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J$:...Ja:...Jm:...J.:...J.:...J.:...J.:.. J.:..!J ;.."J5;..#JJ;..$JM;..%Jg;..&J.;..'J.<..(J.<..)J.=..*J"=..+JL=..,J[=../Jz=..0J.>..1J.>..2J.>..3J.?..5JC?..6J.?..7J)@..8J:@..9JF@..:Jl@..;J.A..<J.B..=J.B..>J.B..@J.C..BJ.C..CJ.C..DJ(C..EJ<C..FJaC..KJ.C..LJ.C..MJ?D..NJaD..OJtD..PJ.D..QJ.E..RJeE..SJ.E..TJ.E..WJ.F..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.G..aJ$G..bJ%G..cJ:G..dJ=G..eJkG..fJ.G..gJ.G..hJ.G..iJ.H..kJ.H..mJBH..nJGH..oJUH..pJ.H..qJ.H..tJxJ..wJ.J..xJ.J..yJ.J..zJ.J..{J.K..}J2K...JFK

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\cs.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):110242
                                                                                                                                                                                      Entropy (8bit):5.8210765375728135
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:6G+wdXqt5qYSP7ymjLEwoVD33zSYoYlBw/dhRRkP+8QUQdbiE:JvXPjyfaYl6/P2+8QUQdbd
                                                                                                                                                                                      MD5:0325D16A747CCA73A3A2B0C94FAC123D
                                                                                                                                                                                      SHA1:E5989627742ECEE5F8996001002E97627BFBE10D
                                                                                                                                                                                      SHA-256:C00829FC57C7E1E5419FE3202F114D394A590B8B32B1E55AF42772C93755945D
                                                                                                                                                                                      SHA-512:B824297DF25C097251432FA72AE1258092E692FF3E4C527599897D7D3E71007CBD80E300DE54B87146889F71D537C7D297C1B3CAC04B6E08D7CE29132EC9E5DC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.j4..k.y4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5....$5....)5....15....95....A5....H5....O5....V5....W5....X5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....)6....86....I6....P6....S6....T6....a6....n6....u6....}6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0..7..1.I7..2.W7..3.e7..4..7..5..7..6..7..7..7..>..8..?..8..N.#8..g.*8..i.-8..j.18..k.68..l.A8...IF8...I_8...I.9...I.9...JA9...JH9...JN9...JT9...Jo9...Jz9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. Jd:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.:..'JK;..(J.;..)J.<..*J1<..+J_<..,Jn<../J.<..0J.=..1J.=..2J.=..3J.=..5J'>..6J.>..7JP?..8Jb?..9Ju?..:J.?..;J.A..<J.B..=JPC..>J.C..@J.C..BJ.C..CJ.C..DJ.C..EJ.C..FJ.D..KJTD..LJrD..MJ.D..NJ.D..OJ.E..PJDE..QJ.E..RJ.E..SJ&F..TJQF..WJ.F..ZJ.G..[J.G..\J.G..]J"G..^J%G.._J;G..`JSG..aJbG..bJeG..cJvG..dJyG..eJ.G..fJ.G..gJ.H..hJ.H..iJ3H..kJ:H..mJ]H..nJdH..oJqH..pJ.H..qJ.I..tJ&L..wJ;L..xJOL..zJ.L..{J.L..}J.L...J.L...JZM

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\da.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100898
                                                                                                                                                                                      Entropy (8bit):5.423694312690139
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:mjAsKH2oFmMFyHlqByQxTdofWfZg5Q4+xEGqZ4w8pOmPEFh/j4O:mM9WohFyFnQBf2+xgL1/r
                                                                                                                                                                                      MD5:29F37A66AD8035D0657A1C7176330C40
                                                                                                                                                                                      SHA1:EBF26AFA557B44FF5248207425083C750A397F49
                                                                                                                                                                                      SHA-256:6DA77A20FD6FBB228B2DE5F197225342DA18CBC58D26EBF542CF20D23E00F033
                                                                                                                                                                                      SHA-512:4C360F13C499A9B4B8E2B6F29EFECEDCC571130B90CB93A3C21486642704711DB0A182B63B3BE307B39C382DE73787269822AF76AF9032E4F9C4A5596EAE8E50
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........)...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|.$5..}.65....>5....C5....K5....S5....[5....b5....i5....p5....q5....r5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....#6....76....I6....P6....S6....T6....[6....d6....j6....m6....t6.....6.....6.....6.....6..*..6..+..6..,..6../..6..0..6..1..7..2..7..3.&7..4.@7..5.X7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.8...I.8...I.8...J.8...J.8...J.8...J.9...J/9...J79...JF9...JR9...J.9...J.9...J.9...J.9...J.9...J.9.. J.:..!J,:.."J::..#JJ:..$JP:..%Jf:..&J.:..'J.:..(JH;..)J.;..*J.;..+J.;..,J.;../J.<..0J|<..1J.=..2J.=..3J<=..5Jg=..6J.=..7JF>..8JO>..9J^>..:Jx>..;J.?..<J/@..=J.@..>J.@..@J.A..BJ.A..CJ.A..DJ#A..EJ-A..FJgA..KJ.A..LJ.A..MJFB..NJ_B..OJpB..PJ.B..QJ.B..RJ2C..SJ}C..TJ.C..WJ4D..ZJ]D..\JeD..]JkD..^JnD.._J.D..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.E..gJRE..hJdE..iJzE..kJ.E..mJ.E..nJ.E..oJ.E..pJ.E..qJ0F..tJLH..wJcH..xJ~H..yJ.H..zJ.H..{J.H..}J.H...J.H...JfI

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\de.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):108417
                                                                                                                                                                                      Entropy (8bit):5.4792271676996425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:hHbausrKfikXgkNahUnNqRPIYvfrxWRQNCLubXpkHxQ1NlkGfChxCPQl9v83Opra:pinhUnN1dLq+H8Nr40PyqyrsS0
                                                                                                                                                                                      MD5:5F9F5187B2C3A4BBE6077A329EF5C2C1
                                                                                                                                                                                      SHA1:68AB6991F89F5C41C055B07FD97EA6D394D87F12
                                                                                                                                                                                      SHA-256:E964D841B9588B7412F1FF86F004E6B052F993BF2153E4DC4BEE6C5536BE1744
                                                                                                                                                                                      SHA-512:560A90D24C5FBA776AE526033163CE61662978599C4B171F0BDBC80C72206A9443ED1AAB58819AE71345ECAFA795527C0673C12B73BA7AC381B7DEF7BBBEE118
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.T4..k.c4..l.n4..n.v4..o.{4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..5.....5.....5.....5....#5....+5....25....95....@5....A5....B5....{5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....(6....A6....Z6....a6....d6....e6....o6....y6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0..7..1.;7..2.I7..3.R7..4.y7..5..7..6..7..7..7..>..8..?..8..N.+8..g.68..i.98..j.=8..k.F8..l.L8...IY8...Iv8...IJ9...IT9...Jx9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J):...J7:...JG:...JP:...J`:...Jo:.. J.:..!J.:.."J.:..#J.:..$J.;..%J(;..&JY;..'J.;..(Jp<..)J.=..*J*=..+JS=..,Jd=../Jx=..0J.>..1J.>..2J.>..3J.?..5J8?..6J.?..7J"@..8J)@..9J4@..:JU@..;JsA..<J.A..=J.B..>J.B..@J.C..BJ.C..CJ.C..DJ C..EJ/C..FJfC..KJ.C..LJ.C..MJpD..NJ.D..OJ.D..PJ.D..QJ!E..RJuE..SJ.E..TJ.F..WJ.F..ZJ.F..\J.F..]J.F..^J.F.._J.F..`J.G..aJ,G..bJ-G..cJ@G..dJCG..eJmG..fJ.G..gJ.G..hJ.G..iJ.H..kJ%H..mJCH..nJMH..oJ[H..pJ~H..qJ.H..tJ}J..wJ.J..xJ.J..yJ.J..zJ.J..{J.K..}J!K...J0K...J.K

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\el.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):188491
                                                                                                                                                                                      Entropy (8bit):4.875423021643058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:lA6xGMCiJFTYkDuTX9yGwSREF3IVMRm5ppFFSqu/EFMeELO+niKh52hfZPXYlXSG:lAACiJFMkDuTyF3IiRm5ppFLzFMeF+n/
                                                                                                                                                                                      MD5:F4083CF1C56EDB2D8701FC1809C9D8EC
                                                                                                                                                                                      SHA1:909337883E1F898C98DE9B35F7889D257E5455B2
                                                                                                                                                                                      SHA-256:B624633365C19E6E3CBE200B39889711994809796DBEE7988883165D0CC1D6C2
                                                                                                                                                                                      SHA-512:27726B5CF51760D6938C17E3B1346F0F9C36940A94FBB9428D9BA8809598E07D7C5429FCFC3EC56EA795D65555B4D19676CDC299D0F8937C503D92CB87B80EE4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5.....6....C6....|6....~6.....6.....6.....6.....6.....6.....7....=7....j7....q7....t7....u7.....7.....7.....7.....7.....7.....7.....8.....8....J8..*._8..+.b8..,..8../..8..0..8..1.m9..2..9..3..9..4..9..5.;:..6..:..7..:..>..;..?.*;..N.K;..g._;..i.b;..j.f;..k.k;..l.u;...Iz;...I.;...I8=...IP=...J.=...J.=...J.=...J.=...J.>...J.>...Jc>...Jw>...J.>...J.?...J0?...JD?...Jf?...J.?.. J&@..!Jm@.."J.@..#J.@..$J.@..%J.A..&J.A..'JxB..(JDC..)J<D..*JbD..+J.D..,J.D../J.E..0J3F..1J.G..2J.G..3J.H..5JSH..6JNI..7J.I..8J.J..9J8J..:J}J..;JrL..<JOM..=JTN..>J.N..@J.O..BJ#O..CJ>O..DJOO..EJnO..FJ.O..KJ8P..LJ.P..MJ.Q..NJ.Q..OJ.Q..PJtR..QJ8S..RJ.S..SJ.T..TJ.T..WJ.V..ZJqV..[J.V..\J.V..]J.V..^J.V.._J.V..`J.W..aJ#W..bJ$W..cJCW..dJFW..eJsW..fJ.W..gJSX..hJkX..iJ.X..kJ.X..mJ.X..nJ.Y..oJ.Y..pJVY..qJ.Y..tJ.\..wJ.]..xJ=]..yJ.]..zJ.]..{J.^..}J>^...J[^

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\en-GB.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):89514
                                                                                                                                                                                      Entropy (8bit):5.4765832263521075
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:c1BQQyiGUaBWTHjrDXApScz4RrgasTX65iBxgwSOiJedMJrV0h5BvVfm3ggl+qRR:c/QJDU9HjHBVsdBxgXM523ggl+qH
                                                                                                                                                                                      MD5:B8B8DE138E6CD2AD1EEE182F2BEFC905
                                                                                                                                                                                      SHA1:ACB5FBB8D3026D2CF0D5AFCC0B2407F7DC7F7CEE
                                                                                                                                                                                      SHA-256:4A5E6439C6731A5273970C8C053B4A89018C57F1D9BE81D85F24978233675442
                                                                                                                                                                                      SHA-512:C5575F68AEE1284A82A47E4D412DF6175550BDE1D8FFD3845D295F88687ECE4A7C04F0AB9FCAB78182FCABB6876CCB9A1F6EE815B0ABC0EB96FE59F5FF849E4B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........(...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|."5..}.45....<5....A5....I5....Q5....Y5....`5....g5....n5....o5....p5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....%6....:6....A6....D6....E6....M6....U6....\6....a6....f6....q6....u6....|6.....6..*..6..+..6..,..6../..6..0..6..1..7..2..7..3..7..4.-7..5.D7..6.v7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...Ir8...Ix8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J!9...J+9...J:9...J>9...JH9...JQ9.. J.9..!J.9.."J.9..#J.9..$J.9..%J.9..&J.:..'J]:..(J.:..)J.;..*J.;..+J=;..,JI;../JZ;..0J.;..1J.<..2J.<..3J.<..5J.<..6J/=..7J.=..8J.=..9J.=..:J.=..;J.>..<J+?..=J.?..>J.?..@J.?..BJ.?..CJ.?..DJ.@..EJ.@..FJ*@..KJ`@..LJ.@..MJ.@..NJ.@..OJ.A..PJ(A..QJ~A..RJ.A..SJ.B..TJ'B..WJ.B..ZJ.B..[J.B..\J.B..]J.B..^J.B.._J.B..`J.C..aJ C..bJ!C..cJ,C..dJ/C..eJPC..fJjC..gJ.C..hJ.C..iJ.C..kJ.C..mJ.C..nJ.C..oJ.D..pJ!D..qJoD..tJ.E..wJ.E..xJ.E..yJ.F..zJ.F..{J!F..}J;F...JEF

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\en-US.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):90228
                                                                                                                                                                                      Entropy (8bit):5.468679281798329
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:lnI8PwZKfs9B0fYSED0TI4RVQ2trM8M5Xx5dBxgZSO0JedMVrBHhBeVfD3ggl+CA:LEKE2YStRdMLBxgsvBq3ggl+CGwG
                                                                                                                                                                                      MD5:AF5C77E1D94DC4F772CB641BD310BC87
                                                                                                                                                                                      SHA1:0CEEB456E2601E22D873250BCC713BAB573F2247
                                                                                                                                                                                      SHA-256:781EF5AA8DCE072A3E7732F39A7E991C497C70BFAEC2264369D0D790AB7660A4
                                                                                                                                                                                      SHA-512:8C3217B7D9B529D00785C7A1B2417A3297C234DEC8383709C89C7FF9296F8ED4E9E6184E4304838EDC5B4DA9C9C3FE329B792C462E48B7175250EA3EA3ACC70C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........2...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..5..w..5..y.!5..z.05..|.65..}.H5....P5....U5....]5....e5....m5....t5....{5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....$6....96....N6....U6....X6....Y6....a6....i6....p6....u6....z6.....6.....6.....6.....6..*..6..+..6..,..6../..6..0..6..1..7..2.&7..3.,7..4.@7..5.W7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J49...J=9...JL9...JP9...JZ9...Jc9.. J.9..!J.9.."J.9..#J.9..$J.9..%J.9..&J.:..'Jf:..(J.:..)J.;..*J";..+JG;..,JS;../Jh;..0J.;..1J.<..2J.<..3J.<..5J.<..6J7=..7J.=..8J.=..9J.=..:J.=..;J.>..<J_?..=J.?..>J.@..@J(@..BJ.@..CJ8@..DJ?@..EJJ@..FJf@..KJ.@..LJ.@..MJ.A..NJ0A..OJ@A..PJhA..QJ.A..RJ.B..SJDB..TJhB..WJ.B..ZJ.C..[J.C..\J.C..]J#C..^J'C.._J9C..`JOC..aJbC..bJcC..cJnC..dJqC..eJ.C..fJ.C..gJ.C..hJ.C..iJ.D..kJ.D..mJ4D..nJ8D..oJGD..pJcD..qJ.D..tJ.F..wJ3F..xJBF..yJaF..zJgF..{J~F..}J.F...J.F

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\es-419.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):106030
                                                                                                                                                                                      Entropy (8bit):5.373963649438172
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Y1zfcN6nwhQppC6SGDYjRbqZrtlaUuzHjqXGiMdePcHYD9KeO0KWFsMH5BthDViT:ahnwhQu6Psl6pMFmI2Be
                                                                                                                                                                                      MD5:84A1995559E8FC00C3E46BA63EFF51A6
                                                                                                                                                                                      SHA1:24B57BABEE3291419FC29AAB9C9A2FC0FE9C3D8A
                                                                                                                                                                                      SHA-256:2E1CF9D3E3EEBE607DA44873CFE37B9A84615962E3450313C3947920D4DE4FDA
                                                                                                                                                                                      SHA-512:1B8453367BBEB12F237F850EB0EF67D4B6CAA973F2E6ACCDAE6FF5B7B3991D5BE2C5D76F787D2C7CA5A10D2D0A92B47FD55141C9D900C850F80CD916ABF5425A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........%...j.|4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|..5..}..5....65....;5....C5....K5....S5....Z5....a5....h5....i5....j5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....06....H6....`6....g6....j6....k6....t6....}6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..7../.&7..0./7..1.e7..2.y7..3..7..4..7..5..7..6..8..7."8..>.:8..?.D8..N.Y8..g.e8..i.h8..j.l8..k.q8..l.y8...I~8...I.8...If9...Io9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J':...J2:...JL:...JS:...Jp:...J.:.. J.:..!J.;.."J.;..#J%;..$J*;..%JH;..&Jv;..'J.;..(Ja<..)J.<..*J.=..+J1=..,JD=../Jd=..0J.=..1J.>..2J.>..3J.>..5J$?..6J.?..7J.@..8J.@..9J!@..:JF@..;J'A..<J.A..=J(B..>J.B..@J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.C..KJKC..LJ{C..MJ.C..NJ.D..OJ.D..PJGD..QJ.D..RJ.E..SJ\E..TJ.E..WJWF..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.F..bJ.F..cJ.F..dJ.F..eJ'G..fJEG..gJ.G..hJ.G..iJ.G..kJ.G..mJ.G..nJ.G..oJ.G..pJ.H..qJzH..tJ.J..wJ.J..xJ;J..yJkJ..zJtJ..{J.J..}J.J...J.J

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\es.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):108109
                                                                                                                                                                                      Entropy (8bit):5.35370843761187
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:CPOLX5pxZkWBvJdYx/TFKYM3vtdThgFW9XlhgoThoK/rh2L1w3Oy:C2vkwcx4v5F1tYC3z
                                                                                                                                                                                      MD5:4ACAD14261FA458CBC61451F4255C891
                                                                                                                                                                                      SHA1:BFBF2429190B85F692BC97D12822CEDD53A70742
                                                                                                                                                                                      SHA-256:B927984D25359F3D7A20D71AA4B16D2EC4C574461177825B5221865F416D1E71
                                                                                                                                                                                      SHA-512:24A71134F5C8F3E03B29491E11D0D0D2B9988C2528593C753893986C6DB6FF2BD88E2E5389B086E0785E24141894441EFE3DB976111E2AD5EE5AFBF7374FEC1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........)...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|.$5..}.65....>5....C5....K5....S5....[5....b5....i5....p5....q5....r5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....16....D6....\6....t6....{6....~6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..7../..7..0.57..1.j7..2.~7..3..7..4..7..5..7..6..8..7.'8..>.<8..?.F8..N.[8..g.g8..i.j8..j.n8..k.w8..l..8...I.8...I.8...I.9...I.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...JZ:...Je:...J.:...J.:...J.:...J.:.. J.:..!J2;.."JB;..#JT;..$JY;..%Jw;..&J.;..'J.<..(J.<..)J.=..*J+=..+JV=..,Jf=../J.=..0J.>..1J.>..2J.>..3J.>..5J.?..6J.?..7J.?..8J.?..9J.@..:J0@..;J+A..<J.A..=J.B..>JwB..@J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.B..KJNC..LJ~C..MJ.C..NJ.D..OJ'D..PJjD..QJ.D..RJ:E..SJ.E..TJ.E..WJuF..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.G..bJ.G..cJ.G..dJ.G..eJCG..fJfG..gJ.G..hJ.G..iJ.G..kJ.G..mJ.H..nJ.H..oJ.H..pJCH..qJ.H..tJ.J..wJ3J..xJQJ..yJyJ..zJ.J..{J.J..}J.J...J.J

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\et.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):96956
                                                                                                                                                                                      Entropy (8bit):5.455086908059335
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:BnHIHEpX0aM3DS4xyGXcen6dg9NzuLECchVjpsPQHXG:BnHiEiaMe4x06NyLiV2PQHW
                                                                                                                                                                                      MD5:3F2F42E0E8FFE5C26295F5E15480EDCA
                                                                                                                                                                                      SHA1:E183E93FE99145CE0471687E930926018B1FCC19
                                                                                                                                                                                      SHA-256:9CDEFC472C67247E67DA040B984E800CC8B903A1B39C742E6962FF5C423F391E
                                                                                                                                                                                      SHA-512:BB61DA1665100B59433D03D05FCD074D36E07EA3C29F2F7C5305E2B560E2A2A8FC508D38B45798D98CD3C1987165667CD723726397E3D1E4BE006C17EFE11C3B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..5..w..5..y..5..z.(5..|..5..}.@5....H5....M5....U5....]5....e5....l5....s5....z5....{5....|5.....5.....5.....5.....5.....5.....5.....6.....6.....6...."6....26....A6....V6....j6....q6....t6....u6....~6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0..7..1.G7..2.R7..3.^7..4.u7..5..7..6..7..7..7..>..7..?..8..N..8..g..8..i.!8..j.%8..k.,8..l.38...I>8...IZ8...I.9...I.9...J69...J=9...JI9...JR9...Ji9...Jo9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. Ja:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.:..'JG;..(J.;..)J.<..*J1<..+JT<..,Jb<../J{<..0J.<..1J.=..2J.=..3J.=..5J.=..6Ji>..7J.>..8J.>..9J.>..:J.?..;J.@..<J.@..=J.@..>J%A..@J?A..BJGA..CJSA..DJZA..EJlA..FJ.A..KJ.A..LJ.A..MJVB..NJvB..OJ.B..PJ.B..QJ.C..RJXC..SJ.C..TJ.C..WJ:D..ZJXD..\J_D..]JbD..^JgD.._J}D..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.E..gJcE..hJ.E..iJ.E..kJ.E..mJ.E..nJ.E..oJ.E..pJ.F..qJ^F..tJ.G..wJ.G..xJ.G..yJ.H..zJ.H..{J0H..}JPH...J^H...J.H

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\fa.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):151026
                                                                                                                                                                                      Entropy (8bit):5.181938015353535
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:QXP4Rawpa8C96NS9/W2ESEmGzR2XQmN4o6TwNv7fizfb8YIO8jdr8TwatK/E3oLF:QXP4Rawpa8C96NS9/W2ESEmGV2XQmN4s
                                                                                                                                                                                      MD5:0FBE88D360ABC020EF6D511FF5CB70A5
                                                                                                                                                                                      SHA1:8ABC47BC30BB0128B84CA4335DC09A67B051EDF4
                                                                                                                                                                                      SHA-256:7E8F7F42300178F001EA5F74C63DB25D813B7C25989114DC7673C76FD92A72C9
                                                                                                                                                                                      SHA-512:1EB2F414521B4EAD4ECCC26305CF89EDDF2A9E26BC5E8D100946A8B442694E48DF6FDCDE858197B23CDD47C83ED7C316D280A642017E7516C5DB73C3322FBA26
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.B4..k.Q4..l.\4..n.d4..o.i4..p.v4..q.|4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..4.....4.....5.....5.....5.....5.... 5....'5.....5....05....x5.....5.....5.....5.....5.....6.....6.....6....#6....:6....`6....}6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....7.....7....27....`7..*.s7..+.v7..,..7../..7..0..7..1..8..2..8..3.,8..4.]8..5..8..6..8..7.'9..>.`9..?.k9..N..9..g..9..i..9..j..9..k..9..l..9...I.9...I.9...I.:...I.;...JO;...JW;...Jl;...Jy;...J.;...J.;...J.;...J.;...JQ<...Jb<...J.<...J.<...J.<...J.<.. J-=..!Ja=.."J|=..#J.=..$J.=..%J.=..&J0>..'J.?..(J.?..)J.@..*J.@..+J*A..,J;A../JbA..0JMB..1J.C..2J.C..3J.C..5J,D..6J.D..7J.E..8J.E..9J.E..:J+F..;J.H..<J.I..=J.J..>J.J..BJ!K..CJ=K..DJKK..EJbK..FJ.K..KJ-L..LJ.L..MJ.M..NJ<M..OJcM..PJ.M..QJ-N..RJ.N..SJ#O..TJ`O..WJ,P..ZJ{P..\J.P..]J.P..^J.P.._J.P..`J.P..aJ.P..bJ.P..cJ.Q..dJ.Q..eJ]Q..fJ.Q..gJ.R..hJ>R..iJvR..kJ.R..mJ.R..nJ.R..oJ.R..pJ.S..qJ.S..tJ!W..wJ.W..xJ.W..yJ.X..zJ!X..{J_X..}J.X...J.X...JGY...J.Y...J.Z...JEZ

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\fi.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):99485
                                                                                                                                                                                      Entropy (8bit):5.416956540869923
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:6EsQoWFTTTqWU9S0JEji18vlhROdA0EjjNM1TO9mRX:6EFf7iE218vUd4shX
                                                                                                                                                                                      MD5:0C5F18712C639646E37FED054781B147
                                                                                                                                                                                      SHA1:FAECB7CB6838783E15BC52C8DC019736A334D59B
                                                                                                                                                                                      SHA-256:4E538A14F1DBC872A85FDB4BE1E19145553ECFA3B07EE7C810B690C52B889684
                                                                                                                                                                                      SHA-512:EF9F1158C35045BBEF92FE70D9006CD7DCC3C834F5A4BEBA5B269AD6C16F9790E316B7E2617100567919AD647A1353CFA8B80D5EDE23CEC9E5F7AE9B4E49C154
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.h4..k.w4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5...."5....'5..../5....75....?5....F5....M5....T5....U5....V5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....(6....76....>6....A6....B6....K6....S6....Z6...._6....f6....u6....}6.....6.....6..*..6..+..6..,..6../..6..0..6..1.'7..2.57..3.D7..4.`7..5.z7..6..7..7..7..>..7..?..7..N..8..g.&8..i.)8..j.-8..k.28..l.:8...I?8...I\8...I.9...I)9...JZ9...Ja9...Ji9...Jt9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J.:...J-:.. Js:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.;..'Js;..(J.;..)J5<..*JH<..+Jr<..,J.<../J.<..0J,=..1J.=..2J.=..3J.>..5J?>..6J.>..7J.?..8J.?..9J$?..:JG?..;J3@..<J.@..=J.A..>JRA..@JrA..BJvA..CJ.A..DJ.A..EJ.A..FJ.A..KJ.B..LJ)B..MJ}B..NJ.B..OJ.B..PJ.B..QJ.C..RJ[C..SJ.C..TJ.C..WJ5D..ZJ_D..\JgD..]JoD..^JtD.._J.D..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.E..gJQE..hJhE..iJ.E..kJ.E..mJ.E..nJ.E..oJ.E..pJ.E..qJKF..tJ.G..wJ.G..xJ.G..yJ.G..zJ.G..{J.H..}J2H...JBH...J.H

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\fil.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):110288
                                                                                                                                                                                      Entropy (8bit):5.196308788997154
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:3NqmgtbTGldYzVgQNjLeyspz4NvuNpEWnGkuljgOAM64CzPEchYkZzk17PaXmAMD:sbTEd07PjgOAaCzh7VSKmAW
                                                                                                                                                                                      MD5:249AC7111D6310C67B42E973F6AA7646
                                                                                                                                                                                      SHA1:DB19F2FA4EEEEC09906ED31BF6295E7831BF9E2C
                                                                                                                                                                                      SHA-256:CB536B478FEFFD3B55EC53676CCE84CEFC9E000C1205273BAFCDAF6EE6EDD381
                                                                                                                                                                                      SHA-512:E96D000925BE9FAE898602F5D62AE3E642E91AA2957D723FFDFE9CAC9BD277BA2155BE31620FBC326D5CC43D47A0E08314FE27688A6EAF786491D6B39A52A00A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........(...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|."5..}.45....<5....A5....I5....Q5....Y5....`5....g5....n5....o5....p5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....!6....:6....Q6....j6....q6....t6....u6.....6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..7../..7..0.77..1.k7..2.|7..3..7..4..7..5..7..6..7..7..8..>..8..?.68..N.I8..g.T8..i.W8..j.[8..k.`8..l.n8...Is8...I.8...ID9...IL9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J+:...J::...J@:...JP:...J_:.. J.:..!J.:.."J.:..#J.:..$J.;..%J.;..&J?;..'J.;..(J.<..)J.<..*J.<..+J.<..,J.<../J.=..0J.=..1JY>..2Jk>..3J.>..5J.>..6J#?..7J.?..8J.?..9J.?..:J.@..;JxA..<J:B..=J.B..>J*C..@JKC..BJUC..CJiC..DJqC..EJ.C..FJ.C..KJ.C..LJ.D..MJ~D..NJ.D..OJ.D..PJ.D..QJOE..RJ.E..SJ.E..TJ"F..WJ.F..ZJ.F..[J.F..\J.G..]J.G..^J.G.._J'G..`JCG..aJXG..bJYG..cJjG..dJmG..eJ.G..fJ.G..gJ.H..hJ"H..iJ>H..kJJH..mJrH..nJxH..oJ.H..pJ.H..qJ!I..tJMK..wJmK..xJ.K..yJ.K..zJ.K..{J.K..}J.K...J.L

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\fr.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):116577
                                                                                                                                                                                      Entropy (8bit):5.38655533656306
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:4RR3mKv3ixbJPRQUClLZkyv6mQKyIwKByroFDuFcZYjlguPyNn/Uv:4z3rPixdPR3ClLZkyv6myIwKgrwDuFAk
                                                                                                                                                                                      MD5:0B5AF66A1378557717B72F84A6E9C2C3
                                                                                                                                                                                      SHA1:B98FE52F6BDD39453DA79EDACF144F6C1E41FD81
                                                                                                                                                                                      SHA-256:BE6CF9443A8D5E0AFBC36FEB2550C9B1C3C0D7481986C2CBA9B0E0F8A5972FC9
                                                                                                                                                                                      SHA-512:95FF6A6605956447AE2B82505807CB610AD7FB17430FE5F79B19F21C484B6D72E4A71D1040B375CB83388E1EE57C7303934AB1DC1C71A22F7635E015B1830ED9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.l4..k.{4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5....&5....+5....35....;5....C5....J5....Q5....X5....Y5....Z5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....,6....D6....K6....N6....O6....W6...._6....h6....n6....u6.....6.....6.....6.....6..*..6..+..6..,..6../..6..0..7..1.C7..2.V7..3.`7..4.~7..5..7..6..7..7..7..>..8..?..8..N.08..g.<8..i.?8..j.C8..k.H8..l.N8...IQ8...Ip8...IB9...II9...Jm9...Jx9...J.9...J.9...J.9...J.9...J.9...J.9...J5:...J>:...JT:...J_:...Jv:...J.:.. J.:..!J.;.."J.;..#J0;..$J2;..%JV;..&J.;..'J.<..(J.<..)J5=..*JQ=..+Jw=..,J.=../J.=..0J8>..1J.?..2J.?..3J4?..5Jf?..6J.?..7J.@..8J.@..9J.@..:J.A..;J.B..<J.C..=JLD..>J.D..BJ.D..CJ.D..DJ.D..EJ.D..FJ E..KJnE..LJ.E..MJ.F..NJ2F..OJEF..PJzF..QJ.F..RJeG..SJ.G..TJ.G..WJ.H..ZJ.H..[J.H..\J.H..]J.H..^J.I.._J.I..`J(I..aJ;I..bJ<I..cJSI..dJ^I..eJ.I..fJ.I..gJ.I..hJ.J..iJ'J..kJ5J..mJXJ..nJ`J..oJnJ..pJ.J..qJ.K..tJ.M..wJ.M..xJ.M..zJ.N..{J!N..}J=N...JRN...J.N...J.O

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\gu.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):212334
                                                                                                                                                                                      Entropy (8bit):4.468693017407305
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:vLx83is0a1A626ZO8n308LcKHdO3C362oY5maBeQOo5qP2G/KO4ue5GS2TsfWsjE:vL18qxv
                                                                                                                                                                                      MD5:CF428ECEC583B73172FA789BA3F9AA6B
                                                                                                                                                                                      SHA1:9A7456009B5A53C4F6470A370319395DA394E462
                                                                                                                                                                                      SHA-256:1D4D407233A4C78D5A9A242B43B21AA89FB68A0632BC52B0A515D69491632E85
                                                                                                                                                                                      SHA-512:2F86F9679E04B8188D7CE44BF0A7BF4B998D9771E9A8A83B4BE4DBA5E5D21EBF6A00091792896D9A8D4ED38EAECD43D8D2CAD920237AF1EA702DADC0341BE9C9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5....)6....Z6.....6.....6.....6.....6.....6.....7....$7....C7....p7.....7.....7.....7.....7.....7.....7.....7.....8....'8....H8....T8....v8.....8..*..8..+..8..,..8../..9..0.=9..1..9..2..9..3..9..4..:..5.H:..6..:..7..:..>.9;..?.L;..N..;..g..;..i..;..j..;..k..;..l..;...I.;...I.;...Ij=...I.=...J.=...J.=...J.=...J.>...J@>...JS>...J.>...J.>...Jw?...J.?...J.?...J.?...J.?...J.@.. J.@..!J.A.."J.A..#JWA..$JjA..%J.A..&J.B..'J&C..(J'D..)J0E..*J^E..+J.E..,J.E../J#F..0JkG..1J)I..2JFI..3J.I..5J.J..6J8K..7J[L..8J.L..9J.L..:J5M..;J.P..<JRR..=JxS..>J.S..@J`T..BJpT..CJ.T..DJ.T..EJ.T..FJ!U..KJ.U..LJ2V..MJ9W..NJcW..OJ.W..PJ.W..QJ.X..RJ.Y..SJ`Z..TJ.Z..WJ.[..ZJD\..[J`\..\J.\..]J.\..^J.\.._J.\..`JK]..aJ.]..bJ.]..cJ.]..dJ.]..eJ.^..fJc^..gJ._..hJ-_..iJ._..kJ._..mJ.`..nJ.`..oJ8`..pJ.`..qJla..tJ.f..wJ.f..xJ4g..yJ.g..zJ.g..{J.g..}J*h...JMh

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\he.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):132154
                                                                                                                                                                                      Entropy (8bit):4.844933793112407
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:IH8reuJQWaOKXLpiglHN58nX3XTnw2FCC9V:DeuJWhXLpiglHN58nHXTnw2FCC9V
                                                                                                                                                                                      MD5:A275C3557E819C6E9FB029643E38FA17
                                                                                                                                                                                      SHA1:8C005CB081417FF2BE0D7D8FB6356519A96F5703
                                                                                                                                                                                      SHA-256:4A9862EE8E139AE74E6336E0207D484E1A1AE0F689B5F1CC06B6FEA66D2090D9
                                                                                                                                                                                      SHA-512:72936FFB29AD5B7FAB17357286EEE7FA9A6B933423FC8618B19FDD841B37D9CC613A35E04614CB74F69F49A4E8BF7A8B48BB55A10E160D8363DBDF697BC314C6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.T4..k.c4..l.n4..n.v4..o.{4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..5.....5.....5.....5....#5....+5....25....95....@5....A5....B5.....5.....5.....5.....5.....5.....5.....5.....6.....6....A6....X6....k6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....7..../7..*.:7..+.=7..,.[7../.l7..0.y7..1..7..2..7..3..7..4..8..5.18..6.u8..7..8..>..8..?..8..N..8..g..8..i..8..j..8..k..8..l..8...I.8...I.9...I.:...I.:...JM:...JW:...Ja:...Jv:...J.:...J.:...J.:...J.:...J1;...J>;...JS;...J];...Jz;...J.;.. J.;..!J#<.."J8<..#JQ<..$JY<..%J.<..&J.<..'JR=..(J.=..)J.>..*J.>..+J.>..,J.>../J.?..0J.?..1J.@..2J.@..3J.@..5J0A..6J.A..7J.B..8J.B..9J.B..:J.C..;J.E..<J.F..=J.H..>JZH..@J.H..BJ.H..CJ.H..DJ.H..EJ.H..FJ.I..KJfI..LJ.I..MJ.J..NJJJ..OJaJ..PJ.J..QJ'K..RJ{K..SJ.K..TJ.L..WJ.L..ZJ.L..[J.M..\J.M..]J.M..^J M.._JEM..`JcM..aJ}M..bJ~M..cJ.M..dJ.M..eJ.M..fJ.N..gJ.N..hJ.N..iJ.N..kJ.N..mJ.O..nJ.O..oJ)O..pJdO..qJ.P..tJ.S..wJ.S..xJ.S..yJ.T..zJ(T..{JET..}JeT...JzT

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\hi.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):219113
                                                                                                                                                                                      Entropy (8bit):4.437297845271283
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:+8UrfNIncwfKSIv73cdEVhkAovrCFO/S/+fm2BfvTH+f+aJBKfzzruE3b8RLljlB:/Urfm+59R
                                                                                                                                                                                      MD5:EB017AC26477D54C707D3E965EC352C5
                                                                                                                                                                                      SHA1:112001C7A38D9B95D3D0E422E10C585079356018
                                                                                                                                                                                      SHA-256:06424570167C9BDD7E13B115A632D6AB58DE7A4FA14F8D094627BD12D85E9318
                                                                                                                                                                                      SHA-512:8DFB1F8B18AE62841A40DE244CE725B9AD865B4DE7D250C0D5799F6896D274276E73672E3DE455D0312A397D20598C768462895E4A768511B7CA530717611837
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.P4..k._4..l.j4..n.r4..o.w4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..5.....5.....5.....5.....5....'5.....5....55....<5....=5....>5.....5.....5.....6....B6....s6....u6....y6.....6.....6.....6.....6.....7....L7....v7....}7.....7.....7.....7.....7.....7.....7.....8....08....I8...._8.....8..*..8..+..8..,..8../..9..0..9..1..9..2..9..3..9..4..:..5.I:..6..:..7..:..>.C;..?.V;..N..;..g..;..i..;..j..;..k..;..l..;...I.;...I.<...I+>...ID>...J.>...J.>...J.>...J.>...J ?...J9?...J~?...J.?...JU@...Jy@...J.@...J.@...J.@...J.@.. J.A..!J.A.."J-B..#JbB..$JrB..%J.B..&J6C..'J-D..(J.E..)J.F..*J:F..+JyF..,J.F../J.F..0J.H..1J.I..2J.I..3J#J..5J.J..6J.K..7J.M..8J?M..9JpM..:J.M..;J.P..<J!R..=J\S..>J.S..@J!T..BJ7T..CJVT..DJhT..EJ.T..FJ)U..KJZV..LJ.V..MJ.W..NJ.W..OJ.X..PJMX..QJ#Y..RJ.Y..SJ.Z..TJ_[..WJ.\..ZJ.\..\J.]..]J.]..^J.].._Jj]..`J.]..aJ.^..bJ.^..cJ8^..dJ;^..eJ._..fJa_..gJ._..hJ0`..kJp`..mJ.`..nJ.`..oJ.`..pJ]a..qJCb..tJ.i..wJwi..xJ.i..yJ$j..zJ:j..{J.j..}J.j...J.j...J.k...J.l

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\hr.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):105383
                                                                                                                                                                                      Entropy (8bit):5.507562593845028
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:MMN0LeqtKRxAGCyle77l/XpUa+tbakWlMMoLu87R53Kkx9i:Mfyr5nKp
                                                                                                                                                                                      MD5:551026FCBD640C1B911ED5B4CB7ADA68
                                                                                                                                                                                      SHA1:3AAC7631C7F23E15A1ABC4FA1CEE98ACB695AADB
                                                                                                                                                                                      SHA-256:CC48D7DEAF73103E22E3E5900503396E2A2C9E5BF1450A4DF8CE94179B1E47A2
                                                                                                                                                                                      SHA-512:7BED851ACC8A137C481968902006917C6EABDF1476C4CD74DEA7BFA731BD45EFF6B742C4B4EF48BA9C9EB4B2BA86C09C14878C05FF797BF56DA075DA9E53BFC9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........'...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|. 5..}.25....:5....?5....G5....O5....W5....^5....e5....l5....m5....n5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....06....F6....M6....P6....Q6....\6....h6....m6....t6....|6.....6.....6.....6.....6..*..6..+..6..,..6../..6..0..7..1.77..2.I7..3.X7..4.u7..5..7..6..7..7..7..>..8..?..8..N."8..g.+8..i..8..j.28..k.98..l.A8...IF8...Id8...I#9...I+9...JS9...JZ9...J`9...Jo9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J+:...J<:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.:..&J&;..'J.;..(J.;..)JW<..*Jk<..+J.<..,J.<../J.<..0J0=..1J.=..2J.=..3J.>..5JM>..6J.>..7J.?..8J.?..9J.?..:J.?..;J.A..<J.B..=J.C..>J.C..@J.C..BJ.C..CJ.C..DJ.D..EJ.D..FJ<D..KJ{D..LJ.D..MJ.E..NJ!E..OJ8E..PJ`E..QJ.E..RJ.F..SJeF..TJ.F..WJ G..ZJEG..\JLG..]JRG..^JXG.._JpG..`J.G..aJ.G..bJ.G..cJ.G..dJ.G..eJ.G..fJ.H..gJPH..hJeH..iJ.H..kJ.H..mJ.H..nJ.H..oJ.H..pJ.H..qJgI..tJ2L..wJGL..xJfL..yJ.L..zJ.L..{J.L..}J.L...J.L...JNM

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\hu.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):113044
                                                                                                                                                                                      Entropy (8bit):5.646517078166082
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:srCzB7nRkbJiKw7UiGKAWEc2dA3RdpEtL1543ICJ:srCV2bOUiGlc1RdpEPu3ICJ
                                                                                                                                                                                      MD5:E51AFBBA3250E655BC01E424A29E3162
                                                                                                                                                                                      SHA1:D7AAF2F2F9629BA9F7CF8A513C2905A13D0B6A8F
                                                                                                                                                                                      SHA-256:61AE4E65474CB4ECF5EDB2EC9BB9EA2B7A47BBF769F81C8FEE1282C13B209783
                                                                                                                                                                                      SHA-512:57FC72149761CDF1DE5C021BF7E63D79D91EF2E54DEA57B9BD9F659DBB2C2F76DC43904C53518C00FE4CA80B92B6FC57489E275FD0006B2295F31DD45C0618EC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....-6....G6....g6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....7..*..7..+."7..,.@7../.Q7..0.[7..1..7..2..7..3..7..4..7..5..7..6."8..7.=8..>.^8..?.k8..N.~8..g..8..i..8..j..8..k..8..l..8...I.8...I.8...Iw9...I.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J :...Ja:...Jq:...J.:...J.:...J.:...J.:.. J.:..!J.;.."J#;..#J6;..$J;;..%JX;..&Jx;..'J.;..(J\<..)J.<..*J.<..+J.=..,J,=../JI=..0J.=..1J.>..2J.>..3J.>..5J.?..6J.?..7J.?..8J.@..9J.@..:J<@..;JUA..<J.A..=JDB..>J.B..@J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ)C..KJ{C..LJ.C..MJ.D..NJ7D..OJLD..PJ.D..QJ.E..RJXE..SJ.E..TJ.E..WJ.F..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.G..`J.G..aJ?G..bJ@G..cJTG..dJWG..eJ.G..fJ.G..gJ.H..hJ0H..iJIH..kJPH..mJ.H..nJ.H..oJ.H..pJ.H..qJ&I..tJ.J..wJ.J..xJ.K..yJ.K..zJ7K..{JSK..}JpK...J.K

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\id.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):96899
                                                                                                                                                                                      Entropy (8bit):5.3420616047371015
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:MJKML7prsGEKho95/SWpEmNUwRKUEJ4eI8B4X1CPXsAzb2ZghlrRGjcCdAbJ:ML76ko95KWy4eIn8XsAzaZGl8cCdO
                                                                                                                                                                                      MD5:564AA91127C872D2C3B2E281137FB1BA
                                                                                                                                                                                      SHA1:556D41A203D15031C6DF5D78154C8F1D86D68F3B
                                                                                                                                                                                      SHA-256:4ED52BA67272F1626B4E7775B3DDF41CEBB9660BD505E269EDE858A15E8D975A
                                                                                                                                                                                      SHA-512:E09F9B113ACA5388DEBD9DABCCAEF63D72B51E4A08067AAD2E8DE6907D337CA61B841488C5408BAFF0DE4F8C1ACE50B8E924724BC1A02B4DF14606066303267A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.b4..k.q4..l.|4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..5..}..5.....5....!5....)5....15....95....@5....G5....N5....O5....P5....s5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....'6.....6....16....26....:6....B6....J6....O6....U6....a6....h6....l6.....6..*..6..+..6..,..6../..6..0..6..1..6..2..7..3..7..4.67..5.H7..6.~7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J.9...J.9...J'9...J49...Js9...J|9...J.9...J.9...J.9...J.9.. J.9..!J.:.."J.:..#J.:..$J#:..%J>:..&Jp:..'J.:..(JE;..)J.;..*J.;..+J.;..,J.;../J.<..0J.<..1J]=..2Jl=..3J~=..5J.=..6J.>..7J{>..8J.>..9J.>..:J.>..;J.?..<J.@..=J.@..>J.@..@J.@..BJ.@..CJ.@..DJ.A..EJ.A..FJ&A..KJhA..LJ.A..MJ.A..NJ.A..OJ.B..PJ5B..QJ.B..RJ.B..SJ.C..TJGC..WJ.C..ZJ.C..[J.C..\J.D..]J.D..^J.D.._J#D..`J;D..aJ\D..bJ]D..cJkD..dJnD..eJ.D..fJ.D..gJ.E..hJ.E..iJ0E..kJ?E..mJ^E..nJbE..oJqE..pJ.E..qJ.E..tJOG..wJaG..xJrG..yJ.G..zJ.G..{J.G..}J.G...J.G

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\it.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):105591
                                                                                                                                                                                      Entropy (8bit):5.277422916407698
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:Ub5255TLQ2Vxyi9yN4tA7kxA78dgDufZfW01c:UFw5TLQ2Vwi9yN4tA7kxA78qkZOac
                                                                                                                                                                                      MD5:FA6ECEAAA453FB66BD631AA9BABE0026
                                                                                                                                                                                      SHA1:790BFEFC29597D09F313C08E7B23FF298D60FA23
                                                                                                                                                                                      SHA-256:4E2089D3FD90977F9A3A88B2AF7FA9FF3B9864969D2F4582431626AE1F37C158
                                                                                                                                                                                      SHA-512:88EB70A25A6B76E5B3272D4BAE0721F23610DDD1284F54CB991EEF3AD78ECA13F47C6A8D79D5FB73F8FE171D5ABEA770B6902D0A1541884CBD5677F3DD4920F5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........#...j.x4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..|..5..}.*5....25....75....?5....G5....O5....V5....]5....d5....e5....f5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....!6....46....L6....b6....i6....l6....m6....{6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..7../..7..0..7..1.d7..2.x7..3..7..4..7..5..7..6..8..7..8..>.08..?.;8..N.L8..g.V8..i.Y8..j.]8..k.d8..l.k8...Iq8...I.8...I]9...Id9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J*:...J3:...JL:...JQ:...Jb:...Jm:.. J.:..!J.:.."J.:..#J.:..$J.;..%J.;..&JJ;..'J.;..(J.<..)J.<..*J.<..+J.<..,J.<../J.=..0J.=..1Jv>..2J.>..3J.>..5J.>..6JL?..7J.?..8J.?..9J.?..:J.?..;J.A..<J.A..=J(B..>JvB..BJ.B..CJ.B..DJ.B..EJ.B..FJ.B..KJ/C..LJcC..MJ.C..NJ.C..OJ.D..PJ@D..QJ.D..RJ.D..SJSE..TJ.E..WJ+F..ZJ]F..[JeF..\JmF..]JqF..^JuF.._J.F..`J.F..aJ.F..bJ.F..cJ.F..dJ.F..eJ.F..fJ.G..gJUG..hJfG..iJ.G..kJ.G..mJ.G..nJ.G..oJ.G..pJ.G..qJ8H..tJ.J..wJ%J..xJ7J..yJ^J..zJcJ..{J.J..}J.J...J.J...J/K

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ja.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):127428
                                                                                                                                                                                      Entropy (8bit):5.826025776360829
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:T0gtNfSwl76rsWg4AkDiQ492E46Tesg+ahB+nLi0doNHVQ:Ig3fjl76IWA+4TiiAB+Li2oNHVQ
                                                                                                                                                                                      MD5:932A8B529D16E79C1471FB8C92109EEB
                                                                                                                                                                                      SHA1:4CEC50AF799472BEA97FC1B1A127C31D9D08B176
                                                                                                                                                                                      SHA-256:275307A3A9708C0698565F10941C57D42E1D2F55709A025D37E588699B5A985E
                                                                                                                                                                                      SHA-512:F2DDB70F819EF08B51C73748F2898EBC987D1D46DFA8E8EA00D2309AC51E37973310BB4F2A3503BB7AD5EF68150B01F3FE5492470D1E30FAB374159EF44F8F4B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j..4..k.+4..l.44..m.<4..o.Q4..p.^4..q.d4..v.s4..w..4..y..4..z..4..|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....4.....4.....4.....5.....5....D5....]5....{5.....5.....5.....5.....5.....5.....5.....5.....5.....6....@6....i6....p6....s6....|6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..7../.'7..0.07..1.u7..2..7..3..7..4..7..5..7..6.58..7.P8..>.n8..?.x8..N..8..g..8..i..8..j..8..k..8..l..8...I.8...I.8...I.9...I.9...J.:...J.:...J.:...J.:...JF:...JL:...Jm:...J.:...J.:...J.:...J.:...J.:...J.;...J-;.. J.;..!J.;.."J.;..#J.;..$J.;..%J.<..&JB<..'J.<..(JP=..)J.=..*J.=..+J">..,J1>../JF>..0J.>..1J.?..2J.?..3J.?..5J;@..6J.@..7JJA..8JhA..9JzA..:J.A..;J.B..<J?C..=J.C..>J.D..@J?D..BJND..CJ`D..DJfD..EJxD..FJ.D..KJ.E..LJ:E..MJ.E..NJ.E..OJ.E..PJ.F..QJeF..RJ.F..SJ#G..TJZG..WJ.G..ZJ:H..\J@H..]JCH..^JFH.._JjH..`J.H..aJ.H..bJ.H..cJ.H..dJ.H..eJ.I..fJ4I..gJ.I..hJ.I..iJ.I..kJ.I..mJ.I..nJ.I..oJ.J..pJ.J..qJ.J..tJeL..wJ.L..xJ.L..zJ.L..{J)M..}JaM...JyM...J.N...J]N...J.N...J.O

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\kn.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):243013
                                                                                                                                                                                      Entropy (8bit):4.364997137141875
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:VwI+rxPrIbgMkipVLe4wrZELNm7SIY/u5ZDu6oSPE7JQO5/d/OACAGAfKI:OI+B0bg4m7S3+ZDu6oSs7JQOV5GAfF
                                                                                                                                                                                      MD5:9224BEB43327CAF18C4FDE76482AE12A
                                                                                                                                                                                      SHA1:EBAA89421838C093E36D74CEC8BB3521772F29CF
                                                                                                                                                                                      SHA-256:1A3FA5261B58113AE1A5CF140ABD93E812B4A866A19A4C54929FFFEE5F42B18B
                                                                                                                                                                                      SHA-512:2C3AE5FD43607F34562B935BF6FB5DC62D083073F430959C4D883C188F744F49AC38D3A3BFA8C3E61113A2E4813D06FCB499FFE3CBFD07979B405B0CD6EB2432
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........"...j.v4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..|..5..}.(5....05....55....=5....E5....M5....T5....[5....b5....c5....d5.....5....-6....d6.....6.....6.....6.....6.....7....57....f7.....7.....7.....8....H8....O8....R8....T8....l8.....8.....8.....8.....8.....9.....9....-9....h9..*..9..+..9..,..9../..9..0..9..1..:..2..:..3..:..4..;..5.c;..6..;..7..<..>.b<..?.u<..N..<..g..<..i..<..j..<..k..<..l..<...I.<...Ig=...Ib?...I.?...J.?...J.?...J.@...J5@...J.@...J.@...J.@...J.A...J.A...J.B...JIB...JXB...J.B...J.B.. JYC..!J.C.."J.C..#J,D..$JDD..%J.D..&J.E..'JNF..(JRG..)JdH..*J.H..+J.H..,J(I../J.I..0J.K..1J(M..2J?M..3J.M..5J'N..6JqO..7J.P..8J+Q..9JVQ..:J.Q..;J.U..<J?W..=J.X..>JZY..BJ.Y..CJ.Z..DJ.Z..EJEZ..FJ.Z..KJ.[..LJ.\..MJ:]..NJm]..OJ.]..PJ6^..QJ3_..RJ.`..SJ.`..TJYa..WJ.b..ZJ6c..[JQc..\Jlc..]J~c..^J.c.._J.c..`J9d..aJwd..bJxd..cJ.d..dJ.d..eJ.d..fJFe..gJ.f..hJ$f..iJrf..kJ.f..mJ.f..nJ.f..oJ.g..pJsg..qJ.h..tJ.n..wJ&o..xJyo..yJ.o..zJ.o..{J9p..}Jip...J.p...J.q

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ko.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107006
                                                                                                                                                                                      Entropy (8bit):6.13524501321474
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:L6jlXiuY72PcT5t4CuAJq/4KiWgDqbYSwnT:WjllY7e6teKQezSwT
                                                                                                                                                                                      MD5:D6C5199671535C5B644D730C9D8C9063
                                                                                                                                                                                      SHA1:7BC876A53B0DA752FC93A088AF1ECD043DEA6AD0
                                                                                                                                                                                      SHA-256:0A46CCE08401A72E44178349A61CDBAE5FD78CA4F071BFF2BF5F2E8C877A25F8
                                                                                                                                                                                      SHA-512:71F8C2A676C7E672476D578EC36D8E9B16F823FE257F7DA7C22B84DCDEBFB7C18480FB52A386F14B9D60D2AAC6C322AAEDE7D61F3032842D3BF713EDDA8CF857
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j..4..k..4..l.'4..m./4..o.54..p.<4..q.B4..r.Q4..s.b4..t.k4..y..4..z..4..|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....4.....4.....4..../5....;5....K5....^5....n5....p5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6.....6....,6....26....;6....M6..*.Z6..+.]6..,..6../..6..0..6..1..6..2..7..3..7..4.17..5.Y7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..8...I.8...I;8...I.8...I.9...J)9...J29...J;9...JG9...J[9...Ja9...Jn9...J~9...J.9...J.9...J.9...J.9...J.:...J':.. Jm:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.;..'J.;..(J.<..)J.<..*J.<..+J.<..,J.<../J.<..0J.=..1J.>..2J.>..3J.>..5J.>..6Jo?..7J.?..8J.?..9J.?..:J.@..;J*A..<J.A..=J>B..>J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.C..KJ[C..LJ.C..MJ.C..NJ.D..OJ*D..PJTD..QJ.D..RJ.D..SJRE..TJwE..WJ.F..ZJ3F..\J9F..]J<F..^JBF.._JVF..`JvF..aJ.F..bJ.F..cJ.F..dJ.F..eJ.F..fJ.G..gJPG..hJdG..iJ.G..kJ.G..mJ.G..nJ.G..oJ.G..pJ.G..qJ*H..tJ.I..wJ.I..xJ.I..zJ.I..{J.J..}J J...J0J...J.J...J.J...J;K...J.K...J.K...J.K

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\lt.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):114368
                                                                                                                                                                                      Entropy (8bit):5.628766403232453
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:RmrvD38onfyORY5gaJzU5R8FYlKUxnaJGN5c0z5PEAy6K5rmz3MWbhg5m1NqF6Sb:Y738oKGyQfKenaIcApbXdtrqF6S05nI
                                                                                                                                                                                      MD5:29AEEB61DF906C770E43ED477160F5BC
                                                                                                                                                                                      SHA1:D3224DFF1967DDD1618D1573D91C3149DED8AE3E
                                                                                                                                                                                      SHA-256:225E5784A7A616F83D81E6F3FDC5510E975E9FBDE741B673DEECE5DED1604A9D
                                                                                                                                                                                      SHA-512:09F601216EF230C20E58391C566CAF388B0ED5421CACBC06FD50BEF242ACAC599E09F92FE63AA055DD314E0EBE9985B76016D82D32B426E51B1F63C7B888AC9A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........!...j.t4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}.&5.....5....35....;5....C5....K5....R5....Y5....`5....a5....b5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....'6....?6....V6....]6....`6....a6....k6....v6....}6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../.)7..0.,7..1.]7..2.n7..3..7..4..7..5..7..6..8..7.98..>.Y8..?.b8..N.u8..g..8..i..8..j..8..k..8..l..8...I.8...I.8...I.9...I.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J,:...Je:...Jo:...J.:...J.:...J.:...J.:.. J.;..!J0;.."JC;..#JT;..$J[;..%Jx;..&J.;..'J"<..(J.<..)J9=..*JS=..+J.=..,J.=../J.=..0JF>..1J.?..2J.?..3J4?..5J]?..6J.?..7J.@..8J.A..9J.A..:J/A..;JYC..<J.D..=J.E..>J.F..@J)F..BJ2F..CJHF..DJQF..EJdF..FJ.F..KJ.F..LJ)G..MJ.G..NJ.G..OJ.G..PJ.H..QJ.H..RJ.H..SJ7I..TJwI..WJBJ..ZJjJ..\JuJ..]J{J..^J.J.._J.J..`J.J..aJ.J..bJ.J..cJ.J..dJ.J..eJ.K..fJ$K..gJeK..hJ.K..iJ.K..kJ.K..mJ.K..nJ.K..oJ.K..pJ.L..qJ.L..tJ.P..wJ.Q..xJ&Q..yJMQ..zJUQ..{JvQ..}J.Q...J.Q...J.R

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\lv.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):113868
                                                                                                                                                                                      Entropy (8bit):5.628642662789089
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:0rv+yaMchZGB5nDJSM+hzyez0YNUc8YjJ8I4WSuAhaIphcmE425BaYK/faVdX1:0rvdapZGTmUc8Yd8ScVfaVdF
                                                                                                                                                                                      MD5:CE3CB88E12F86EB6F6AD23A4D34F49E5
                                                                                                                                                                                      SHA1:31ED4DDBFE6BEFA49C6C28089EDB1B1617D896BD
                                                                                                                                                                                      SHA-256:D58B6308B64A1CDA4EE0B2B395672728CE7ABB73C44961FC911386569CAEE60E
                                                                                                                                                                                      SHA-512:5DB77B4E3FE2A2C76FC15134B7DB1C4ACDCD08CD296AA1657A08B55871353FC7F911222FF16078379A8596D401A66272A431FA9FEFF8BDA5BEDAC9D7479D02F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........*...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....,6....>6....W6....o6....v6....y6....z6.....6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..7../.=7..0.M7..1..7..2..7..3..7..4..7..5..7..6..8..7.88..>.L8..?.T8..N.d8..g.n8..i.q8..j.u8..k.z8..l..8...I.8...I.8...IT9...I]9...J}9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J::...JF:...JW:...J`:...Jt:...J.:.. J.:..!J.:.."J.;..#J";..$J(;..%J=;..&Jb;..'J.;..(JT<..)J.<..*J.<..+J.=..,J"=../J==..0J.=..1J.>..2J.>..3J.>..5J.?..6Jz?..7JD@..8JK@..9J\@..:J.@..;J.B..<J.C..=J=D..>J.D..@J.D..BJ.D..CJ.D..DJ.D..EJ.D..FJ.E..KJRE..LJvE..MJ.E..NJ.E..OJ.F..PJ:F..QJ.F..RJ.F..SJ&G..TJUG..WJ.G..ZJ.H..[J.H..\J"H..]J*H..^J.H.._JOH..`JeH..aJ.H..bJ.H..cJ.H..dJ.H..eJ.H..fJ.H..gJ8I..hJOI..iJtI..kJ{I..mJ.I..nJ.I..oJ.I..pJ.I..qJaJ..tJIM..wJdM..xJ.M..yJ.M..zJ.M..{J.M..}J.M...J.N

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ml.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):256394
                                                                                                                                                                                      Entropy (8bit):4.3824317738273235
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:ipt3yrxsIaPEL+YBkW4m/rvFdq2C1TmHh03m:mtGpaPk/XJdPETS03m
                                                                                                                                                                                      MD5:AA549352CE43C7F3AADCF24DB4B28039
                                                                                                                                                                                      SHA1:52F9DE28A67E438A4B055B0988F2C4DC480A61FA
                                                                                                                                                                                      SHA-256:E51D9A02AD11CB9825368DA9A17AF7294B7E6BF11079E2072E4BEC028ECAF20F
                                                                                                                                                                                      SHA-512:D220AC779B5AA363E4837430FB66FC3833FE0331FBA3C634AD920F8DBA8DBB1F32FDE0EB6DA26CABD9C089326A46252DF22ADE62299D6BC37C9B0F3694E8AB51
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.p4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}."5....*5..../5....75....?5....G5....N5....U5....\5....]5....^5.....5.....6....I6.....6.....6.....6.....6.....7.....7....?7.....7.....7.....7....(8..../8....28....48....U8....s8.....8.....8.....8.....9....09....N9....y9..*..9..+..9..,..9../..:..0..:..1..:..2..:..3..;..4.P;..5..;..6.J<..7..<..>..=..?.&=..N.Z=..g.|=..i..=..j..=..k..=..l..=...I.=...I.>...I.@...I)@...J.@...J.@...J.@...J.@...J+A...J=A...J.A...J.A...JfB...J.B...J.B...J.B...J.C...J@C.. J.C..!JED.."JvD..#J.D..$J.D..%J-E..&J.E..'J.F..(J.G..)J=I..*J{I..+J.I..,J,J../JyJ..0J.L..1J:N..2JQN..3J.N..5J?O..6J.P..7J.Q..8J.Q..9J.R..:J~R..;JJU..<J]V..=J<W..>J.X..@JcX..BJ~X..CJ.X..DJ.X..EJ.X..FJlY..KJ~Z..LJ.Z..MJ.\..NJ>\..OJ.\..PJ.]..QJ.^..RJ.^..SJ._..TJ@`..WJ.a..ZJ[b..\J.b..]J.b..^J.b.._J.b..`J<c..aJvc..bJwc..cJ.c..dJ.c..eJ.d..fJPd..gJ.e..hJDe..iJ.e..kJ.e..mJ2f..nJ]f..oJ.f..pJ.f..qJ.g..tJdk..wJ.k..xJ.k..yJtl..zJ.l..{J.m..}JCm...Jkm...J.n

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\mr.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):209573
                                                                                                                                                                                      Entropy (8bit):4.450668379803355
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:LM82qbqMB6D/W502ZleTc7eegSZhBFvWSLQEDE5dEBZt+TYjDR6KAu:Jwtu
                                                                                                                                                                                      MD5:896759A28D38E5D8F415570DD6F4D85E
                                                                                                                                                                                      SHA1:23F55CDE464192839434A1E727CEB285B8B1F82B
                                                                                                                                                                                      SHA-256:4293AFACF1C4DCE2423C368A45FEC4B33AAC7232E7B7C1919AA8A5A20FB026A1
                                                                                                                                                                                      SHA-512:4392943394E2EBC257ED230F993D6F0280AD4106E2623BD9A498C8CBB8DCAF05A49FB998F855FBBA637030F43E68D15DC429D71604EF285F211A9C86480C4E60
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.T4..k.c4..l.n4..n.v4..o.{4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..5.....5.....5.....5....#5....+5....25....95....@5....A5....B5.....5.....5.....6...."6....o6....q6....u6.....6.....6.....6.....6.....7....>7....b7....i7....l7....n7.....7.....7.....7.....7.....7.....8.....8.... 8....U8..*.y8..+.|8..,..8../..8..0..8..1.]9..2.t9..3..9..4..9..5..:..6.o:..7..:..>..:..?..;..N.0;..g.F;..i.I;..j.M;..k.R;..l.c;...Ih;...I.;...Ix=...I.=...J.=...J.=...J.=...J.>...JU>...Jn>...J.>...J.>...JZ?...Jq?...J.?...J.?...J.?...J.@.. J.@..!J+A.."JWA..#J.A..$J.A..%J.A..&J[B..'JcC..(JZD..)JTE..*J.E..+J.E..,J.F../JRF..0J.G..1J.I..2J.I..3J.I..5JUJ..6J.K..7J.L..8J.L..9J.M..:JhM..;J.O..<J.P..=J.Q..>J)R..@J.R..BJ.R..CJ.R..DJ.R..EJ.S..FJaS..KJ T..LJ}T..MJsU..NJ.U..OJ.U..PJlV..QJXW..RJ.X..SJ.X..TJUY..WJ.Z..ZJ.[..[J.[..\JA[..]JP[..^J\[.._J.[..`J.[..aJ(\..bJ)\..cJR\..dJU\..eJ.\..fJ.\..gJW]..hJt]..iJ.]..kJ.]..mJ+^..nJ=^..oJT^..pJ.^..qJ2_..tJyb..wJ.b..xJ.c..yJcc..zJrc..{J.c..}J.c...J.d

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ms.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):99639
                                                                                                                                                                                      Entropy (8bit):5.243278535485018
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Hcy5Z74bI/tcHEry1GQ/ApwYXBSBYOYSjfhos036Kw+8uDe:8yT4bIKEGqwYXBSdJo76Kp8uDe
                                                                                                                                                                                      MD5:407DD10484A99B21FFDAE6016132BF26
                                                                                                                                                                                      SHA1:D1D7A5524FDF026A49391522C42D059406BD0442
                                                                                                                                                                                      SHA-256:83248A2AAEFB87FC19454AFA34BF5DF99B95B98F823B534DE0BAE552C8260D93
                                                                                                                                                                                      SHA-512:908B71411E34EC56E77C5837A856898F929DDDC81D95A7E2B6D47F4F4E1D72B499D627A8CEC7233E4F39292F592B6A90354E6325AAFACC145C994ABEA1FF6F64
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.d4..k.s4..l.~4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..5..}..5.....5....#5....+5....35....;5....B5....I5....P5....Q5....R5....|5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....'6....@6....W6....^6....a6....b6....l6....w6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..6..0..7..1.77..2.D7..3.O7..4.n7..5..7..6..7..7..7..>..7..?..7..N..8..g..8..i..8..j..8..k."8..l.*8...I/8...IG8...I.8...I.8...J.9...J$9...J*9...J19...JH9...JP9...Jn9...J{9...J.9...J.9...J.9...J.9...J.9...J.9.. JH:..!Jc:.."Jo:..#Jw:..$J~:..%J.:..&J.:..'J$;..(J.;..)J.;..*J.<..+J(<..,J3<../JO<..0J.<..1J.=..2J.=..3J.=..5J.=..6J4>..7J.>..8J.>..9J.>..:J.>..;J.?..<JI@..=J.@..>J.@..@J.A..BJ.A..CJ!A..DJ*A..EJ9A..FJUA..KJ.A..LJ.A..MJ.B..NJ,B..OJ;B..PJhB..QJ.B..RJ.C..SJaC..TJ.C..WJ.D..ZJ@D..\JFD..]JKD..^JPD.._JbD..`JyD..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.D..gJ<E..hJQE..iJeE..kJsE..mJ.E..nJ.E..oJ.E..pJ.E..qJ.F..tJ.G..wJ.G..xJ.G..yJ.H..zJ.H..{JAH..}J\H...JlH...J.H

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\nb.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98518
                                                                                                                                                                                      Entropy (8bit):5.395332505716346
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:gom2lbcn3CeEFoivwBiXEHZqFdIm8VUvCAchEHAxF:gc4nymDHZqFdIwC7F
                                                                                                                                                                                      MD5:1BDFC009F54C1E5BC8EEEB5017F9DE53
                                                                                                                                                                                      SHA1:7427D3F37771886AF1C0AF1D20468960C524377D
                                                                                                                                                                                      SHA-256:21F3EFE54A2A0ED9E2F618B2A50F89B44957BC7C779E7F88C1F10B310CEA8BD5
                                                                                                                                                                                      SHA-512:EEE4AED543D30C7A74A64350CF67B454EC4AD56DC6A51F88DEC648B80A33146F5BD3FFADAB16A1F0B8E1FFE427F56F58A86DA748ED1B118EA7FA72610D84C07A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....%6....(6....)6....06....86....C6....G6....N6....Y6....`6....d6....|6..*..6..+..6..,..6../..6..0..6..1..6..2..6..3..7..4.$7..5.97..6.p7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J 9...J(9...J@9...JM9...J.9...J.9...J.9...J.9...J.9...J.9.. J.:..!J1:.."JA:..#JQ:..$JW:..%Jl:..&J.:..'J.;..(Jv;..)J.;..*J.;..+J.<..,J.<../J*<..0J.<..1J2=..2JA=..3JQ=..5J}=..6J.=..7JG>..8JW>..9Jd>..:J.>..;Jn?..<J.?..=JR@..>J.@..@J.@..BJ.@..CJ.@..DJ.@..EJ.@..FJ.A..KJBA..LJmA..MJ.A..NJ.B..OJ.B..PJQB..QJ.B..RJ.B..SJCC..TJnC..WJ.D..ZJCD..\JJD..]JPD..^JSD.._JgD..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.D..gJ/E..hJAE..iJZE..kJbE..mJ.E..nJ.E..oJ.E..pJ.E..qJ.F..tJsG..wJ.G..xJ.G..yJ.G..zJ.G..{J.G..}J.H...J!H...J.H

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\nl.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101895
                                                                                                                                                                                      Entropy (8bit):5.3499106046374685
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:u6KTrYE5am7spkFjegH7IINejowGTielwo6ytW9:kNjeKqRmUyc9
                                                                                                                                                                                      MD5:FA16E91633AA0F20E49B7E19BB57AACB
                                                                                                                                                                                      SHA1:595D392D20DF35ED71F4461CD5C85B77A68612F1
                                                                                                                                                                                      SHA-256:E94551CA94505F068ECD0619AF676B7B3A869F6068AF87F0F537CACE8055BA4B
                                                                                                                                                                                      SHA-512:D3FA50F247CB216E07D4905BFEC4AB39D15BBC9B60CF0E3DC733BDCD2A0CBB1F8513589C40111335797248119E59AB2D2D46C2CF18C496796FD4B7233A829A30
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........$...j.z4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..|..5..}.,5....45....95....A5....I5....Q5....X5...._5....f5....g5....h5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....)6....D6....U6....\6...._6....`6....m6....z6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..6..0..7..1.B7..2.N7..3.[7..4.v7..5..7..6..7..7..7..>..7..?..8..N..8..g.'8..i.*8..j..8..k.58..l.;8...I@8...I\8...I/9...I89...JV9...J^9...Jd9...Jn9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J.:.. J]:..!J{:.."J.:..#J.:..$J.:..%J.:..&J.:..'JK;..(J.;..)J.<..*J%<..+JR<..,Ja<../Ju<..0J.<..1J.=..2J.=..3J.=..5J.=..6Jc>..7J.>..8J.>..9J.>..:J.?..;J.@..<J.@..=J.A..>JNA..@JqA..BJzA..CJ.A..DJ.A..EJ.A..FJ.A..KJ.B..LJ=B..MJ.B..NJ.B..OJ.B..PJ.C..QJoC..RJ.C..SJ.C..TJ+D..WJ.D..ZJ.D..[J.D..\J.E..]J.E..^J.E.._J#E..`J=E..aJOE..bJPE..cJ[E..dJ^E..eJ.E..fJ.E..gJ.E..hJ.F..iJ'F..kJ.F..mJJF..nJRF..oJ`F..pJ.F..qJ.F..tJ.H..wJ.H..xJ.H..yJ.H..zJ.H..{J.I..}J/I...JBI

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\pl.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):110678
                                                                                                                                                                                      Entropy (8bit):5.741625091591969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:t8ZTz/RoRMa8odxIQW6AeJJzg349OM4oNsNYyhIi+3ZyL5kA:t8Nz/eIQDg3Y4rYIIi+3Ze
                                                                                                                                                                                      MD5:DA0BFC4EF754490879E8DD567961064A
                                                                                                                                                                                      SHA1:F331C571422C5BB85F90FE915756AD9787103C24
                                                                                                                                                                                      SHA-256:C57C2E534DA554E42388815CD3E848630ED46E1E61E640A6F3D4FD7CBDFB2AED
                                                                                                                                                                                      SHA-512:1CCDE932C1354FC0880AFB7EB1FE9A8B93297CFBB21E0DBDB78A07B116B951672A2D1DD25E0DC94FA1384AC7BB22A007B468A391457851BF8C88EFB9708A7F37
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........%...j.|4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|..5..}..5....65....;5....C5....K5....S5....Z5....a5....h5....i5....j5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....(6....>6....U6....\6...._6....`6....k6....w6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0.&7..1.U7..2.d7..3.m7..4..7..5..7..6..7..7..7..>..8..?..8..N./8..g.98..i.<8..j.@8..k.E8..l.L8...IQ8...Io8...I=9...ID9...Jp9...Jw9...J}9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J.:...J3:...J@:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.;..'J.;..(J.;..)Ju<..*J.<..+J.<..,J.<../J.<..0Ji=..1J.>..2J)>..3J;>..5Js>..6J.>..7J.?..8J.?..9J.?..:J.?..;J.A..<J.B..=JRC..>J.C..@J.C..BJ.C..CJ.C..DJ.C..EJ.C..FJ.D..KJFD..LJjD..MJ.D..NJ.D..OJ.D..PJ!E..QJxE..RJ.E..SJ.F..TJ5F..WJ.F..ZJ.F..[J.F..\J.F..]J.F..^J.G.._J.G..`J.G..aJHG..bJIG..cJ`G..dJcG..eJ.G..fJ.G..gJ.G..hJ.G..iJ.H..kJ.H..mJ?H..nJEH..oJRH..pJrH..qJ.H..tJ.K..wJ.K..xJ.L..yJDL..zJLL..{J^L..}JyL...J.L...J.M

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\pt-BR.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):105311
                                                                                                                                                                                      Entropy (8bit):5.420675337894776
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:TTEl8e6Vb//PtDjipJtpm/QzrKj0Y0X4xhBc6x0xGUY3yDeMTwO5e:fEl8eyb/XR9/QrKJL5XMTlk
                                                                                                                                                                                      MD5:31E00C1FDFB9F86D7F5B5B285689CFF8
                                                                                                                                                                                      SHA1:C5131466499D78C7282F29B3B12F8934A139991F
                                                                                                                                                                                      SHA-256:ED9ADACAD575344216EE986E9C04908A5093AA7A0EBFBF2549DF4C668A35F356
                                                                                                                                                                                      SHA-512:B36B87330B29F99CA32D781175F1FD485FA034EAFA2458F4191B70BDBFB2866FD56EDB0E97CE7232B0DC3135B939EB7AC1161B1002D9322DBC7EE016B8069F09
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........%...j.|4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|..5..}..5....65....;5....C5....K5....S5....Z5....a5....h5....i5....j5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6..../6....E6....[6....b6....e6....f6....o6....x6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0..7..1.;7..2.N7..3.X7..4.|7..5..7..6..7..7..7..>..7..?..8..N..8..g.%8..i.(8..j.,8..k.18..l.88...I=8...IX8...I.9...I.9...J?9...JG9...JM9...J^9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. J[:..!J}:.."J.:..#J.:..$J.:..%J.:..&J.:..'Jf;..(J.;..)JN<..*Jh<..+J.<..,J.<../J.<..0JW=..1J+>..2JA>..3JU>..5J.>..6J.>..7J|?..8J.?..9J.?..:J.?..;J?A..<J.A..=J.B..>J.B..@J!C..BJ)C..CJ5C..DJ?C..EJNC..FJqC..KJ.C..LJ.C..MJHD..NJZD..OJoD..PJ.D..QJ.E..RJUE..SJ.E..TJ.E..WJvF..ZJ.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.F..bJ.F..cJ.G..dJ.G..eJ0G..fJWG..gJ.G..hJ.G..iJ.G..kJ.G..mJ.G..nJ.H..oJ.H..pJ3H..qJ.H..tJ.J..wJ.J..xJ.J..yJ.K..zJ.K..{J7K..}JWK...JiK...J.K

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\pt-PT.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):106331
                                                                                                                                                                                      Entropy (8bit):5.4055438207415145
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tcJdPoUL5qsr/y2VfgE5fcBw4d6hrxz2qKHWhLtOAZ12kR9C:+ksrbr0Bw9VtOAz2kzC
                                                                                                                                                                                      MD5:F33190E2616875ED2349115E128A54FB
                                                                                                                                                                                      SHA1:27E44FB2CDFECC19F5C91FF2F2E69956CD59BE57
                                                                                                                                                                                      SHA-256:DA64B5178BB41BE0684CB3EF1204BECB457520FE4960C3252F5CCD6A9EE9E29A
                                                                                                                                                                                      SHA-512:3020DA0FDCF7984557EF7AF1C9F0E7CBD1BF364A8841E6671CEC4B517AC89E9C4BED680A2A2E76B18DB5E2D10C7F1A41C5758306E3F20EB248796B2BE6E02FCB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........*...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.... 6....46....K6....b6....i6....l6....m6....v6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0..7..1.N7..2.a7..3.k7..4..7..5..7..6..7..7..8..>.$8..?./8..N.D8..g.P8..i.S8..j.W8..k.\8..l.c8...Ih8...I.8...II9...IO9...Jt9...J~9...J.9...J.9...J.9...J.9...J.9...J.9...J&:...J4:...JL:...JS:...Jn:...J}:.. J.:..!J.:.."J.:..#J.;..$J.;..%J9;..&Jo;..'J.;..(JN<..)J.<..*J.<..+J.=..,J.=../J6=..0J.=..1J.>..2J.>..3J.>..5J%?..6J.?..7J.@..8J#@..9J;@..:J]@..;JxA..<J.A..=J.B..>J.B..@J.B..BJ.B..CJ.B..DJ.C..EJ.C..FJKC..KJ.C..LJ.C..MJ7D..NJcD..OJsD..PJ.D..QJ.E..RJVE..SJ.E..TJ.E..WJzF..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.G..bJ.G..cJ.G..dJ.G..eJOG..fJzG..gJ.G..hJ.G..iJ.H..kJ.H..mJ;H..nJAH..oJNH..pJwH..qJ.H..tJ.J..wJ.J..xJ.J..yJ.J..zJ.J..{J.K..}J#K...J5K

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ro.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):108582
                                                                                                                                                                                      Entropy (8bit):5.453389680590652
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pvGWGGi3mp16a3y5/zOSoPMyVwPgJe2DLpsPlJtWIhx5h6/uxFDv32B+A:purMpsIFJe2iPzx5h6/uxFr38/
                                                                                                                                                                                      MD5:4C4112B99FDA13B8FA5373D379F476FB
                                                                                                                                                                                      SHA1:2422AFA9EA5B204FE84CC241CF6EDA2C8B319FA2
                                                                                                                                                                                      SHA-256:99730524E53CA07481F8CDBBDACE228AED42ABC19D2277D26C42F47653F3CF07
                                                                                                                                                                                      SHA-512:C663A678D0EEB66697F430E785C32FDB021A40C6456807F3842FA0E2C9AE3450FD59C3EE15E9A0975B8D100FC7C7118A06AFD595404A29D777780106C8E1AD4F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........*...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....%6....86....S6....q6....x6....{6....|6.....6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..7../.67..0.G7..1.s7..2..7..3..7..4..7..5..7..6..8..7.!8..>.88..?.@8..N.O8..g.]8..i.`8..j.d8..k.i8..l.n8...Is8...I.8...IL9...IV9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J*:...J3:...JB:...JR:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.;..&J1;..'J.;..(J.<..)J{<..*J.<..+J.<..,J.<../J.<..0J[=..1J.>..2J.>..3J1>..5J]>..6J.>..7Jg?..8Jr?..9J.?..:J.?..;J.A..<J.A..=JMB..>J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.C..KJMC..LJyC..MJ.C..NJ.C..OJ.D..PJ8D..QJ.D..RJ.D..SJ.E..TJUE..WJ.E..ZJ.F..\J.F..]J.F..^J.F.._J0F..`JJF..aJ]F..bJ^F..cJrF..dJuF..eJ.F..fJ.F..gJ.F..hJ.G..iJ$G..kJ+G..mJJG..nJSG..oJaG..pJ.G..qJ.H..tJ$J..wJ?J..xJ[J..yJ.J..zJ.J..{J.J..}J.J...J.J...JgK...J.K

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ru.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170643
                                                                                                                                                                                      Entropy (8bit):4.97301585978007
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:KWFppsemP4lV+TQUXEmOAdOiOFIQgIvZfbRrK5VH934RzDqa7BLuW1LV2Lle9X+p:KWFpp9mQLPQVOAdOwQgIv1RcVH9IRzhM
                                                                                                                                                                                      MD5:5D77BC0C2AA843EC5BE6A3614C062359
                                                                                                                                                                                      SHA1:0B22C3376169A5BBB4697D586E4A0D3094739DD5
                                                                                                                                                                                      SHA-256:EC6654FFD877EC62D8AFCF90469ECEF5790E17C7306654CFE4B905DE449B06D8
                                                                                                                                                                                      SHA-512:A2CF1FF9F7020BA1998A7091B802DD1AEB59BF2B800A41FF221152E2D017435372BFCD52EC454DB543E856288E2DC381DC46A7926D4BB4B917B8749657FEE0AB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.L4..k.[4..l.f4..n.n4..o.s4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..4.....5.....5.....5.....5....#5....*5....15....85....95....:5.....5.....5.....5.....5.....6.....6.....6.....6....66....H6....g6.....6.....6.....6.....6.....6.....6.....6.....6.....7.....7....47....L7....V7....b7.....7..*..7..+..7..,..7../..7..0..7..1.H8..2._8..3.y8..4..8..5..8..6.S9..7.w9..>..9..?..9..N..9..g..9..i..9..j..9..k..9..l..9...I.:...I7:...I.;...I.;...J.<...J.<...J)<...J@<...Jt<...J.<...J.<...J.<...J,=...JI=...Jf=...Jx=...J.=...J.=.. J.>..!JX>.."Ju>..#J.>..$J.>..%J.>..&J.?..'J.@..(J.@..)JeA..*J.A..+J.A..,J.A../J B..0J.C..1JLD..2JeD..3J.D..5J.D..6J.E..7J.F..8J.G..9J%G..:J}G..;J.K..<J.L..=J9N..>J.N..BJ.N..CJ.N..DJ.O..EJ%O..FJgO..KJ.O..LJ1P..MJ.P..NJ.Q..OJ/Q..PJsQ..QJ.R..RJfR..SJ.S..TJHS..WJ.T..ZJfT..\J|T..]J.T..^J.T.._J.T..`J.T..aJ.U..bJ.U..cJCU..dJFU..eJ.U..fJ.U..gJ.V..hJ;V..iJgV..kJxV..nJ.V..oJ.V..pJ.V..qJ.W..tJw^..wJ.^..xJ.^..zJ.^..{J._..}Jf_...J._...J._...JA`...J.`...J.`

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\sk.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):111961
                                                                                                                                                                                      Entropy (8bit):5.78637987197169
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:ufxhFgi4HHK9eDpYaQWQtTe7hukM+zBHCYaiggGP352wmQPE:hBSaQWI2ukM+zBHCYauGPp2wLPE
                                                                                                                                                                                      MD5:BA56090D9658733694473C7861D04040
                                                                                                                                                                                      SHA1:DDE05B47D06FA81ABADC1B8F74E5993D0EA61CA1
                                                                                                                                                                                      SHA-256:D7BAA6B1C0355E1CE9088C6EB508235C7A640BA70CC7AD84C9AC607026400495
                                                                                                                                                                                      SHA-512:ED49F76F2EF4975E105FE13850258A51E44D0FFA7167A52B398276898237636AA50F62209757DCD756E3FAEF5581E314E261BAA3A1E46B183A3B93AF68605C59
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........)...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..|.$5..}.65....>5....C5....K5....S5....[5....b5....i5....p5....q5....r5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6...."6....36....C6....V6....]6....`6....a6....o6....}6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0..7..1.E7..2.S7..3.c7..4..7..5..7..6..7..7..7..>..8..?..8..N."8..g..8..i.18..j.58..k.>8..l.H8...IM8...Im8...I'9...I19...J[9...Jc9...Ji9...Jy9...J.9...J.9...J.9...J.9...J.:...J.:...J1:...J9:...JH:...JV:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.;..&J5;..'J.;..(J.<..)J.<..*J.<..+J.<..,J.<../J.<..0J~=..1J?>..2JN>..3Jc>..5J.>..6J.?..7J.?..8J.?..9J.?..:J.@..;J.A..<J.B..=J.C..>J.D..@J.D..BJ6D..CJED..DJND..EJ_D..FJ.D..KJ.D..LJ.E..MJ}E..NJ.E..OJ.E..PJ.E..QJ7F..RJtF..SJ.F..TJ.F..WJ.G..ZJ.G..[J.G..\J.G..]J.G..^J.G.._J.G..`J.G..aJ.H..bJ.H..cJ+H..dJ.H..eJnH..fJ.H..gJ.H..hJ.H..iJ.I..kJ.I..mJ1I..nJ9I..oJNI..pJsI..qJ.I..tJ{M..wJ.M..xJ.M..yJ.M..zJ.M..{J.N..}J6N...JHN...J.N

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\sl.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):106585
                                                                                                                                                                                      Entropy (8bit):5.474857990972114
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:RU1M1nublajdqz6HYogW4xVivgnUhXaA99DqJdIqTCORahNNi/fzU1BwwRqt:RUpZWqzon6x8DgIqTCO6Li/fzMwoqt
                                                                                                                                                                                      MD5:B1E33BBB0ABBE113A024694BF4608C5B
                                                                                                                                                                                      SHA1:A157C8578685F5084FD805C9D0734BC7646D77D9
                                                                                                                                                                                      SHA-256:48E9004441F8AFB200601EC2843A03892076DEB1706E1D3A7BBDBFCDD137AB57
                                                                                                                                                                                      SHA-512:94854EB7021AB112B710332A410AF53E59A42C4A501EB02098A41004613E5B2F7727A192C74E2A1C17BFC584A85477E75BD1EEA0187E79DB1DE83C8253BEC322
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.f4..k.u4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5.... 5....%5....-5....55....=5....D5....K5....R5....S5....T5....~5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....56....<6....?6....@6....K6....S6....Y6....^6....f6....q6....v6....|6.....6..*..6..+..6..,..6../..6..0..6..1.#7..2.27..3.?7..4.[7..5.p7..6..7..7..7..>..7..?..7..N..7..g..8..i..8..j..8..k..8..l..8...I.8...IF8...I.9...I.9...J09...J79...JL9...JS9...Jo9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. J^:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.:..'Jh;..(J.;..)JE<..*JY<..+J.<..,J.<../J.<..0J.=..1J.=..2J.=..3J.=..5J.>..6J.>..7Jd?..8Ju?..9J.?..:J.?..;JTB..<JJC..=J;D..>JuD..@J.D..BJ.D..CJ.D..DJ.D..EJ.D..FJ.D..KJ0E..LJXE..MJ.E..NJ.E..OJ.E..PJ.F..QJZF..RJ.F..SJ.F..TJ.G..WJ.G..ZJ.G..[J.G..\J.G..]J.G..^J.G.._J.G..`J.G..aJ.H..bJ.H..cJ.H..dJ.H..eJBH..fJrH..gJ.H..hJ.H..iJ.H..kJ.H..mJ.I..nJ.I..oJ#I..pJJI..qJ.I..tJVM..wJuM..xJ.M..yJ.M..zJ.M..{J.M..}J.N...J.N...J.N

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\sr.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):161804
                                                                                                                                                                                      Entropy (8bit):4.913015445699687
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:u6umjOFT3hFmGK7vVsY+f1GX20Dl370BQn0yh9K3Y+Nst3r1GLTL6itWYJ/k/Zp:HT+TP0B7XDp370+n59URV/k/Zp
                                                                                                                                                                                      MD5:C56D29BCF5FB38EA25AB1A855690F9A9
                                                                                                                                                                                      SHA1:F3161F2890971EF929473C58654DAC0718983957
                                                                                                                                                                                      SHA-256:68A04BAE37629675C49D9AAEB68A1DA974AAC427B61151A18F3210499702202D
                                                                                                                                                                                      SHA-512:551A72041772737139190894F5DEE50963F5597A2271BD2E94AF390CAE34967CC435BF5504601C061CF6C2CCCCD19E7BB708538A6789F185412FC715E85D54BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........,...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..5..w..5..y..5..z.$5..|.*5..}.<5....D5....I5....Q5....Y5....a5....h5....o5....v5....w5....x5.....5.....5.....6....96....n6....p6....t6.....6.....6.....6.....6.....6.....7....47....;7....>7....?7....I7....U7....n7....|7.....7.....7.....7.....7.....7..*..8..+..8..,.$8../.L8..0.U8..1..8..2..8..3..8..4.#9..5.T9..6..9..7..9..>..:..?.$:..N.E:..g.[:..i.^:..j.b:..k.g:..l.u:...Iz:...I.:...I.<...I.<...JU<...Jc<...Jo<...J.<...J.<...J.<...J.=...J.=...Jw=...J.=...J.=...J.=...J.=...J.>.. J.>..!J.>.."J.>..#J ?..$J,?..%J]?..&J.?..'J_@..(J.@..)J.A..*J.A..+J.A..,J.B../J<B..0J.B..1J.D..2J.D..3JBD..5J.D..6JrE..7J.F..8J.F..9J.F..:J.F..;J.J..<JRK..=J.L..>J-M..@JbM..BJnM..CJ.M..DJ.M..EJ.M..FJ.M..KJZN..LJ.N..MJLO..NJuO..OJ.O..PJ.O..QJrP..RJ.P..SJpQ..TJ.Q..WJsR..ZJ.R..[J.R..\J.R..]J.R..^J.R.._J.S..`JDS..aJfS..bJgS..cJ.S..dJ.S..eJ.S..fJ T..gJmT..hJ.T..iJ.T..kJ.T..mJ.T..nJ.U..oJ.U..pJRU..qJ'V..tJ.Z..wJ)[..xJ^[..yJ.[..zJ.[..{J.[..}J.\...J$\

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\sv.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98495
                                                                                                                                                                                      Entropy (8bit):5.49554714075014
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:49G15Swi3ANlCXU8qwJ4Ey9HdSfvlALur/WLdP/ldO12D2CMqeLKBqQOPXE9b3cY:JTvi3AKT8OCbU+Vn3
                                                                                                                                                                                      MD5:2BEFBABEABBBAE5E7C57934ACC5CD41F
                                                                                                                                                                                      SHA1:D48E9FD4D73627F4DCC57EC31924D97F6FD6B8D1
                                                                                                                                                                                      SHA-256:C63E812FEE929492974C9B5DFA14A7587258E6FABED355A105015B296246B068
                                                                                                                                                                                      SHA-512:8E06850701C6BC2A4A5ED8B9D59F68B68D631BE7B037E2DF2A738B5A44D36A37B1419E739341A00EE7681249A434CA69BA53BBC58FF0F204322F7DFDE2D43405
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.j4..k.y4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5....$5....)5....15....95....A5....H5....O5....V5....W5....X5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....&6....-6....06....16....96....A6....L6....R6....Z6....e6....q6....x6.....6..*..6..+..6..,..6../..6..0..6..1..7..2..7..3..7..4.>7..5.S7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.8...I.8...I.8...J.8...J.8...J.8...J.8...J.9...J.9...J19...J?9...Jz9...J.9...J.9...J.9...J.9...J.9.. J.:..!J&:.."J8:..#JD:..$JI:..%Jg:..&J.:..'J.:..(J[;..)J.;..*J.;..+J.<..,J.<../J9<..0J.<..1Jb=..2Jt=..3J.=..5J.=..6J(>..7J.>..8J.>..9J.>..:J.>..;J.?..<J.@..=J.@..>J.@..@J.A..BJ.A..CJ.A..DJ.A..EJ&A..FJMA..KJ.A..LJ.A..MJ.B..NJ1B..OJAB..PJgB..QJ.B..RJ.B..SJHC..TJoC..WJ.C..ZJ.D..[J.D..\J!D..]J'D..^J*D.._JAD..`JWD..aJrD..bJsD..cJ.D..dJ.D..eJ.D..fJ.D..gJ0E..hJEE..iJYE..kJ`E..mJ|E..nJ.E..oJ.E..pJ.E..qJ.F..tJeG..wJzG..xJ.G..yJ.G..zJ.G..{J.G..}J.H...J.H

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\sw.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100164
                                                                                                                                                                                      Entropy (8bit):5.339155264286809
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:AUaDx9XlYKed5nDi5jXmQtVPGoHLeH+jKHw9E:AU8MnDiZmIVaH+jKHw9E
                                                                                                                                                                                      MD5:2490296567A1CD3C7B0852E1ED7D115D
                                                                                                                                                                                      SHA1:04B527742CEA9487344AE08C463D6FD4BA16B1CE
                                                                                                                                                                                      SHA-256:8B07BFAFA5C97BE2DA9B6146535B7848D88A44D43A45AB06DFAE286D93FD64CE
                                                                                                                                                                                      SHA-512:B930C14847012E12BB19BF217C79516C569FC163204D9C2B21A36F6F5061A50C3EC057882970517FC3BC4BEEBCF3D1B1402CCD521404CBA827309940A5496B3F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.^4..k.m4..l.x4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..5.....5.....5....%5....-5....55....<5....C5....J5....K5....L5....p5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....%6....;6....B6....E6....F6....M6....R6....Y6....^6....e6....q6....{6.....6.....6..*..6..+..6..,..6../..6..0..6..1.+7..2.A7..3.K7..4.a7..5.~7..6..7..7..7..>..7..?..7..N..8..g..8..i..8..j. 8..k.%8..l.+8...I/8...Ib8...I69...I;9...J^9...Jb9...Jp9...Jy9...J.9...J.9...J.9...J.9...J.:...J.:...J*:...J1:...JJ:...JV:.. J.:..!J.:.."J.:..#J.:..$J.;..%J.;..&JM;..'J.;..(J%<..)J.<..*J.<..+J.<..,J.<../J.=..0J.=..1Jt>..2J.>..3J.>..5J.>..6J.?..7J.?..8J.?..9J.?..:J.?..;J.@..<J~A..=J.A..>J+B..@JGB..BJMB..CJYB..DJiB..EJsB..FJ.B..KJ.B..LJ.C..MJvC..NJ.C..OJ.C..PJ.C..QJ'D..RJoD..SJ.D..TJ.D..WJkE..ZJ.E..\J.E..]J.E..^J.E.._J.E..`J.E..aJ.E..bJ.E..cJ.F..dJ.F..eJ3F..fJSF..gJ.F..hJ.F..iJ.F..kJ.F..mJ.F..nJ.F..oJ.G..pJ+G..qJsG..tJ.H..wJ.H..xJ.H..yJ!I..zJ*I..{JCI..}J`I...JiI...J.I

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\ta.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):251131
                                                                                                                                                                                      Entropy (8bit):4.183819952310117
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:ow9AvDLcYemZ9w7towiy+bvnTDE2k4ca6QVW0LlGJfB1okotPttRmL+EG5aIAuwA:39I/cXmHw2tRBp
                                                                                                                                                                                      MD5:8C8B63DFB6DBF75603D3E2E4FE981F9D
                                                                                                                                                                                      SHA1:3E7C9A1A01526367B016DF20822A41E430328E94
                                                                                                                                                                                      SHA-256:22EB9D73331E92C898B27546A9E775FA8DF0FDADA391734A9291B2A016662652
                                                                                                                                                                                      SHA-512:978AF09738B4E00BA58F91B82DB6CD455FFB3CB4951C25ABAF79B8159C6FCD9212348373EF5A5A421F9FF5B4604A3F5B54AEA3257DCF566807B6A84824CA54BC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.`4..k.o4..l.z4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..5..}..5.....5.....5....'5..../5....75....>5....E5....L5....M5....N5.....5.....6....D6.....6.....6.....6.....6.....7....(7....G7.....7.....7.....7....38....:8....=8....>8....\8....z8.....8.....8.....8.....8.....9....,9....u9..*..9..+..9..,..9../..9..0..:..1..:..2..:..3..:..4.J;..5..;..6.m<..7..<..>..=..?..=..N.S=..g.l=..i.o=..j.s=..k.x=..l..=...I.=...I.=...I.?...I.?...JE@...JW@...Jo@...J.@...J.@...J.@...J'A...JTA...J.A...J.B...J2B...J>B...JsB...J.B.. JfC..!J.C.."J.C..#J,D..$JGD..%J.D..&J3E..'J.F..(J.G..)J.I..*JTI..+J.I..,J&J../JsJ..0J.K..1J.N..2J.N..3JeN..5J.O..6JiP..7JkQ..8J.Q..9J.R..:J.R..;J$U..<JUV..=JcW..>JcX..@J.X..BJ.X..CJ.Y..DJ.Y..EJIY..FJ.Y..KJ.Z..LJ.Z..MJ.[..NJ(\..OJ.\..PJ.]..QJE^..RJ._..SJ._..TJn`..WJ.b..ZJ{b..[J.b..\J.b..]J.b..^J.b.._J.c..`Jac..aJ.c..bJ.c..cJ.c..dJ.c..eJ2d..fJ.d..gJ.e..hJ.e..iJ.e..kJ(f..mJ.f..nJ.f..oJ.f..pJ=g..qJ<h..tJel..wJ.l..xJ.l..yJrm..zJ.m..{J.n..}JCn...Jen

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\te.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):233515
                                                                                                                                                                                      Entropy (8bit):4.393720868758364
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:li+xJA6UspbDcUSanSBXvQBgIiCQvWSsxU/dUVo9wLwxEE:lHxJA6UspbDcUSanSBXvQBgIiCQvWSse
                                                                                                                                                                                      MD5:8C3DA965070A32BB6DEA236943B340F6
                                                                                                                                                                                      SHA1:F726DDF5052FD3D9D0634250835FCEDACF599603
                                                                                                                                                                                      SHA-256:F36F7AED903CD79D2EA2100B9446E210261AEC24D5910EFCFC04FE30A6CF227F
                                                                                                                                                                                      SHA-512:269E97097C9BB6EAB917C4297E44569A379AA9CE77A3F719043F582DD29894717783A37BED0C1ABBF218597C0BBDE267E048B284B811539985ADC5BA36132F8E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........*...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5....+6...._6.....6.....6.....6.....6.....7....:7....k7.....7.....7.....7.....8.....8...."8....$8....K8....r8.....8.....8.....8.....8.....8.....9....^9..*..9..+..9..,..9../..9..0..9..1..:..2..:..3..:..4..;..5.w;..6..;..7.)<..>..<..?..<..N..<..g..<..i..<..j..<..k..=..l..=...I.=...I.=...Ig?...I.?...J.?...J.?...J.@...J)@...Js@...J.@...J.@...J.A...J.A...J.A...J)B...JBB...J~B...J.B.. JuC..!J.C.."J.D..#JID..$JgD..%J.D..&J.E..'J8F..(J@G..)JeH..*J.H..+J.H..,J.I../JoI..0J&K..1J'M..2J>M..3J.M..5J.N..6JhO..7JBP..8J~P..9J.P..:J.Q..;JYS..<JDT..=J"U..>J.U..@JPV..BJlV..CJ.V..DJ.V..EJ.V..FJRW..KJ)X..LJ.X..MJ.Y..NJ.Y..OJAZ..PJ.Z..QJ.[..RJI\..SJ.]..TJi]..WJ.^..ZJ.^..[J._..\J1_..]J:_..^JR_.._J._..`J._..aJ6`..bJ7`..cJ~`..dJ.`..eJ.`..fJ/a..gJ.a..hJ.b..iJnb..kJ.b..mJ.b..nJ.b..oJ.c..pJxc..qJOd..tJ.g..wJ.g..xJ"h..yJ.h..zJ.h..{J.i..}JEi...J.i

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\th.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):199961
                                                                                                                                                                                      Entropy (8bit):4.471892692957686
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:aMMGozCJFkcSCkIOBrQrUXFIw3reJZK8Q9w1p7ETsGpY0bhdxPtA0kC5/0:aMMnzsFkcSCkIOBrQrUXFIw3reJZK8Qm
                                                                                                                                                                                      MD5:F265EC50E0EB62893FBC187C1C962DD9
                                                                                                                                                                                      SHA1:5A60FF7287E5D4E35F000D229A4CBB37DB76ACC0
                                                                                                                                                                                      SHA-256:CFFD61F7954CA10038529D14FDA6A4E34C8EA1A9F202EAD0B0C2DB93143EF485
                                                                                                                                                                                      SHA-512:696140D16655B6D1C17D59B3E280F3F387ADB8AD58C4A0D369925BD01CF03A3FD934C3B8E02E9E868BB64F81E7CFBFA532E732D1CD705C52C7B0F588765ECBEA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.,4..k.;4..l.A4..o.I4..p.V4..q.\4..r.k4..s.|4..t..4..v..4..w..4..y..4..z..4..|..4..}..4.....4.....4.....4.....4.....4.....5.....5.....5.....5.....5.... 5....k5.....5.....5.....6....R6....T6....X6....j6.....6.....6.....6.....6.....7....17....87....;7....Y7....z7.....7.....7.....7.....7.....7.....7.... 8..*.A8..+.D8..,.U8../..8..0..8..1..9..2.J9..3.b9..4..9..5..9..6.q:..7..:..>..:..?..:..N..;..g.';..i.*;..j..;..k.3;..l.P;...IU;...I.;...I.=...I;=...J.=...J.=...J.=...J.=...J.>...J.>...Je>...J.>...J.?...J1?...J.?...J.?...J.?...J.?.. J}@..!J.@.."J.@..#J.A..$J0A..%J`A..&J.A..'J.B..(J.C..)J.D..*J(E..+JuE..,J.E../J.E..0J.G..1J.H..2J.H..3J.I..5JmI..6JBJ..7J.K..8J,K..9JVK..:J.K..;J.N..<J.O..=J.O..>JlP..@J.P..BJ.P..CJ.P..DJ.P..EJ.Q..FJXQ..KJ.Q..LJ5R..MJ#S..NJIS..OJgS..PJ.S..QJtT..RJ&U..SJ.U..TJ.V..WJ6W..ZJ.W..\J.W..]J.W..^J.W.._J.W..`JAX..aJbX..bJcX..cJ.X..dJ.X..eJ.X..fJ.X..gJUY..hJlY..iJ.Y..kJ.Y..mJ Z..nJ/Z..oJCZ..pJ.Z..qJ.[..tJ.^..wJ.^..xJ.^..yJx_..zJ._..{J._..}J.`...J&`...J=a...J.a

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\tr.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):103632
                                                                                                                                                                                      Entropy (8bit):5.620092397160877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:uTJeZiainAmSngesR/Rv2NEiOwi1PNpskBa5Y8GKhEtJj3:bZMAe8NEhwiBNps2r
                                                                                                                                                                                      MD5:D8373D7BC1BDEE4CFB48D85694A78FF9
                                                                                                                                                                                      SHA1:323408E39B2C953728420E5F21B1D1EB25DE6C2B
                                                                                                                                                                                      SHA-256:B1B66BFEC0AFF21C64EC8BA3F19008501F196F80E7E41B2E8AE73114357DF458
                                                                                                                                                                                      SHA-512:6960D7C0481985E0F151D66D047A02E7C31CDD670AFD71A0A3949B9B0AB9E083A5CA55FAA48E38C8793EBBF1218A4503043867D1999B163A923E5AFCE8058888
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........"...j.v4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..|..5..}.(5....05....55....=5....E5....M5....T5....[5....b5....c5....d5.....5.....5.....5.....5.....5.....5.....6.....6.....6....#6....36....E6....\6....u6....|6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0..7..1.T7..2.a7..3.o7..4..7..5..7..6..7..7..8..>.%8..?..8..N.<8..g.G8..i.J8..j.N8..k.S8..l.Y8...Ib8...I.8...Ir9...I~9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...JP:...Je:...Jr:...Jx:...J.:...J.:.. J.:..!J.;.."J.;..#J#;..$J(;..%J;;..&J];..'J.;..)JP<..*Jc<..+J.<..,J.<../J.<..0JE=..1J.>..2J.>..3J*>..5Jj>..6J.>..7JB?..8JW?..9Ji?..:J.?..;J.@..<J/A..=J.A..>J.A..@J.A..BJ.A..CJ.B..DJ.B..EJ.B..FJCB..KJ.B..LJ.B..MJ.C..NJ8C..OJQC..PJ.C..QJ.C..RJ/D..SJ.D..TJ.D..WJ2E..ZJ[E..[JaE..\JiE..]JkE..^JoE.._J.E..`J.E..aJ.E..bJ.E..cJ.E..dJ.E..eJ.E..fJ.F..gJdF..hJ{F..iJ.F..kJ.F..mJ.F..nJ.F..oJ.F..pJ.G..qJUG..tJ.H..wJ.H..xJ.I..yJ9I..zJEI..{JfI..}J.I...J.I...J.J

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\uk.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):171613
                                                                                                                                                                                      Entropy (8bit):5.007044552893733
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:fxJB3IjwWDCj+KU/TI7Yf7/QLNiXMMQOCqbCEb4UdL+v:5JB3IjwSrILNiXMoCqbbW
                                                                                                                                                                                      MD5:E87CBE2CFFA7D3A95A8F837231D6F44F
                                                                                                                                                                                      SHA1:40F7D1602B47C7A7AD445FE04377E3145F8CAFF7
                                                                                                                                                                                      SHA-256:FA035595C375522D09F9DE5A545F5339FCD3DDB224FB19F1828A7958B7DFF3E8
                                                                                                                                                                                      SHA-512:4A8B970B50DA8B92B824C92C6075C8B4440826DA5A581C91AD6E5B78BC65E3B80BE0080E4FBB20AD91E3EE30F8A3A05CA6925E93C76C8D2474CDB9A8825ACC74
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.h4..k.w4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..|..5..}..5...."5....'5..../5....75....?5....F5....M5....T5....U5....V5.....5.....5.....5.....6....^6....`6....d6....v6.....6.....6.....6.....6.....7..../7....67....97....:7....J7....\7....n7....|7.....7.....7.....7.....7.....7..*..8..+..8..,.#8../.g8..0.y8..1..8..2..8..3..9..4.M9..5.|9..6..9..7..9..>.$:..?.3:..N.T:..g.`:..i.c:..j.g:..k.n:..l.z:...I.:...I.:...I.<...I0<...Jw<...J.<...J.<...J.<...J.<...J.<...J.=...J%=...J.=...J.=...J.=...J.=...J.=...J.=.. J.>..!J.>.."J.>..#J.?..$J.?..&JJ?..'J.?..(J.@..)JnA..*J.A..+J.A..,J.B../JUB..0J0C..1JoD..2J.D..3J.D..5J.E..6J.E..7J{G..8J.G..9J.G..:J.G..;J.L..<J.N..=J.O..>J.O..@J.P..BJ.P..CJ>P..DJWP..EJtP..FJ.P..KJ>Q..LJ.Q..MJ%R..NJLR..OJxR..PJ.R..QJ|S..RJ.S..SJoT..TJ.T..WJ.U..ZJ.V..\J/V..]J;V..^JAV.._JxV..`J.V..aJ.V..bJ.V..cJ.V..dJ.V..eJ9W..fJsW..gJ.W..hJ.X..iJLX..kJ[X..mJ.X..nJ.X..oJ.X..pJ.X..qJ.Y..tJ(`..wJ]`..xJp`..yJ.`..zJ.`..{J.a..}J7a...JRa...J.b...Jfb

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\vi.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122335
                                                                                                                                                                                      Entropy (8bit):5.796834440522502
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:2Qn4KMPnMpPiz+sEqOa2WYmc/1BCa1bNeqhzi5OZpW8uTtdLpFeSZTzeNQ:7n6ZacGbNjzioZWN1
                                                                                                                                                                                      MD5:4BC4E64F60FF1F96F5124A089713FE5A
                                                                                                                                                                                      SHA1:31D3792DF18AAE92D77BD7E4A6A6A2D091AD7BCF
                                                                                                                                                                                      SHA-256:585B6476211FDA89BD97C32E266944ED61E1DBBA660E7F3940DB84C8EB7DD0BB
                                                                                                                                                                                      SHA-512:203FE638C7B066A3AB239642AC3A08475BF0EC114EB48D3339BE81E619EABAB868931BFA6E1344D87F2B9CE6452EC8D71B685D241C9FEE915D1F4978E2143B8D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.L4..k.[4..l.f4..n.n4..o.s4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..|..4..}..4.....5.....5.....5.....5....#5....*5....15....85....95....:5....]5....n5.....5.....5.....5.....5.....5.....5.....5.....5.....6....'6....76....O6....V6....Y6....Z6....c6....l6....x6....~6.....6.....6.....6.....6.....6..*..6..+..6..,..6../..7..0.'7..1.[7..2.h7..3.s7..4..7..5..7..6..7..7..7..>.&8..?.28..N.T8..g.Z8..i.]8..j.a8..k.f8..l.o8...It8...I.8...I.9...I.9...J.9...J.9...J.9...J.:...J*:...J6:...JX:...Jh:...J.:...J.:...J.:...J.;...J.;...J.;.. J~;..!J.;.."J.;..#J.;..$J.;..%J.;..&J3<..'J.<..(J@=..)J.=..*J.=..+J.>..,J.>../J3>..0J.>..1J.?..2J.?..3J.@..5JA@..6J.@..7J)A..8J@A..9JQA..:JsA..;J.B..<J?C..=J.C..>J.D..@J*D..BJ/D..CJ8D..DJKD..EJUD..FJ.D..KJ.D..LJ.D..MJzE..NJ.E..OJ.E..PJ.E..QJWF..RJ.F..SJ.G..TJCG..WJ-H..ZJ_H..[JjH..\JsH..]JyH..^J}H.._J.H..`J.H..aJ.H..bJ.H..cJ.H..dJ.H..eJ.I..fJ5I..gJ.I..hJ.I..iJ.I..kJ.I..mJ.J..nJ$J..oJ3J..pJKJ..qJ.J..tJ.L..wJ.L..xJ.M..yJMM..zJUM..{JzM..}J.M...J.M

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\zh-CN.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):90960
                                                                                                                                                                                      Entropy (8bit):6.704102795095848
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fS4xPz13JLazuzqWI3EnkHhE9vcolEclL:K4Zz13euz3+B8pl9L
                                                                                                                                                                                      MD5:D9FB680D115846809114DE2B35AB4CE3
                                                                                                                                                                                      SHA1:D1F68E0181233C98FFBE91B09910B9D87C1E35EB
                                                                                                                                                                                      SHA-256:690DAFDEB5BE360E8B3A84C711D0D48B3CFC74C871B89A8F03F8058738CA9834
                                                                                                                                                                                      SHA-512:5968BBA15BEBF047DF19B519DA87BDE959CCF1E564012043EA390B3C1E572BBAED79B8BE6BFB884F4F9DA8F1C25F3E6709D6620C582910DEAF723906FDB04525
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j.&4..k.54..l.<4..m.D4..o.J4..p.O4..q.U4..r.d4..s.u4..t.~4..v..4..w..4..|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....4.....5.....5....55....>5....J5....\5....n5....p5....t5....z5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6.....6...."6....66..*.?6..+.B6..,.o6../..6..0..6..1..6..2..6..3..6..4..6..5..7..6.F7..7.[7..>.p7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...Ia8...Ig8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J.9...JE9...JW9...Ji9...Jo9...J~9...J.9.. J.9..!J.:.."J.:..#J.:..$J$:..%J3:..&JZ:..'J.:..(JT;..)J.;..*J.;..+J.<..,J.<../J0<..0J.<..1Je=..2Jv=..3J.=..5J.=..6J.>..7J.>..8J.>..9J.>..:J.>..;J.?..<J.@..=JZ@..>J.@..@J.@..BJ.@..CJ.@..DJ.@..EJ.@..FJ.A..KJNA..LJlA..MJ.A..NJ.A..OJ.B..PJ<B..QJ.B..RJ.B..SJ7C..TJhC..WJ.D..ZJ3D..[J9D..\J?D..]JBD..^JED.._J]D..`JuD..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.D..gJHE..hJ\E..iJkE..kJwE..mJ.E..nJ.E..oJ.E..pJ.E..qJ.F..tJ.G..wJ.G..xJ.G..yJ.G..zJ.H..{J.H..}J<H...JHH...J.H...J.H

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\locales\zh-TW.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):90921
                                                                                                                                                                                      Entropy (8bit):6.701067465304723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Nx0gkZ46QB0MYZ2wcxAhdmDMQ+23mVcb7/8sfjkMQP1Rh5u/UxLiow5No4V3XiP9:PXkZkaMs2TAhdmSYkg35N/9XiPm45ycd
                                                                                                                                                                                      MD5:D0141FD3E851CDB790549C069A76ABCD
                                                                                                                                                                                      SHA1:3DA3787A8EA94AA066C5E5D17E42481330E0CAFF
                                                                                                                                                                                      SHA-256:8187E67CDE3292C6F18EA0A40F8F8D3F2CD604E62FEEC9EC40C71B5D2BCDEC9D
                                                                                                                                                                                      SHA-512:947E19E8FAD3A761E5E1D0380547A8F9BC06F28CF8103D80865EB9CED9E3ED3D601BD92710EF1CB9FA68D56EB62AE95C1AAD78145D455BCB6DDA1B8C280F4162
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............j. 4..k./4..l.:4..n.B4..o.G4..p.O4..q.U4..r.d4..s.u4..t.~4..v..4..w..4..y..4..z..4..|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....5....95....B5....N5....]5....l5....p5....t5....z5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6...."6....(6.....6....B6..*.K6..+.N6..,.~6../..6..0..6..1..6..2..6..3..6..4..6..5..7..6.T7..7.i7..>.{7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J.8...J.8...J.9...J'9...Jc9...Ju9...J.9...J.9...J.9...J.9.. J.9..!J-:.."J<:..#JH:..$JN:..%J`:..&J.:..'J.;..(Jr;..)J.;..*J.;..+J*<..,J6<../JE<..0J.<..1Js=..2J.=..3J.=..5J.=..6J'>..7J.>..8J.>..9J.>..:J.>..;J.?..<J.@..=J`@..>J.@..@J.@..BJ.@..CJ.@..DJ.@..EJ.@..FJ.A..KJDA..LJeA..MJ.A..NJ.A..OJ.A..PJ.B..QJtB..RJ.B..SJ.C..TJ+C..WJ.C..ZJ.C..[J.C..\J.C..]J.C..^J.C.._J.D..`J5D..aJMD..bJND..cJ]D..dJ`D..eJ.D..fJ.D..gJ.D..hJ.E..iJ.E..kJ.E..mJ8E..nJ>E..oJOE..pJdE..qJ.E..tJXG..wJuG..xJ.G..yJ.G..zJ.G..{J.G..}J.G...J.G...JTH...J.H

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources.pak

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5086576
                                                                                                                                                                                      Entropy (8bit):7.950998865230536
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:98304:l3s0L4ikWDclBYCiqOs7y33cJGVh1uiUdrwruUFJ7rK5zkIFvd4XT8:tsQ4ivKYCDJoh8iqkruUXrK5N
                                                                                                                                                                                      MD5:1F95BE6A00B153FD2BA5B149C21E3C25
                                                                                                                                                                                      SHA1:D955B861C86E1D3DE73024B3383AA11264C87BA4
                                                                                                                                                                                      SHA-256:F4EA4113A0DA76D70F72BBEF82374C4EB7E63936E3F6931CC56B27A7300F9715
                                                                                                                                                                                      SHA-512:9BC4EE4344BCBCFCA1F6E84606FD730B21E58ADBDCEB1E47BA23931FF59ABDFF67DB368C912F63C51823A864B91E53699469D52AD9AD33301050D369E79D215E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:........+...f.D...h.M#....U#....Z#...,.&...,.....,.0...,.A...,%K...,.R...,.U...,Z[...,.]...,.`...,.`...,.b...,.b...,.d...,.i...,Dn...,.x...,K....,.....,.....-h....-.....-S....-~....-....-.....-....-.....-i....-.....-.....-.....-.....-.....-.....-]....-.....-.....-.....-N#...-G(...-.<.. -.?..!-y@.."-.C...0.H...0.S...0.T...0.W...0.\...0.e...0=g...0ci...0.}...0.....0.....0Z....0,....0....0.....0@....0.....0.....0q....0.....0T....0.....0}....0.....0.....0I....0-....0p....0.....0.....0l....0.....0.....0_....0Z....0*!...0.4...0.@...0El...0.s...0.....06....0F....0....0n....0....0*....0.....0F....1.....1~....1.....1x....1g....1.....1.....1*....1:....1.....3.....3.....4.....4.....4.....4g....4.....4.....4/....4B....4|....4E....4)....4J....4.....4A....4.!...4oL...4YQ...4.X...4"b...4.c...4.f...4.j...4.q...4.y...4U....4"....@.....@:....@.....@.....@.....@.....@@....@.....@."...@h'...@.,...@.6...@2=...@.O...@6b...@.h...@Vm...@....@.....@....@.....@d....@....@%....@.....@.....@....@.....@,.

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app-update.yml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):168
                                                                                                                                                                                      Entropy (8bit):5.389258774620848
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8tnQfcmkltUHVsZELv9sFPEPDpSWQn0ERXAEBbAB+NyCHgxAAKzecXCJdgv:67UH5LF4gDwWQn9RXhGAHmA+cXT
                                                                                                                                                                                      MD5:EB323EEE2FE05435DCC43B46AE755749
                                                                                                                                                                                      SHA1:0ADBA58BBCC880DC0FCA355348C5BA307DD83ABB
                                                                                                                                                                                      SHA-256:2EA32F6C23775A377481A4AB796901FFDEC770D0151068796429523AC5A7CB99
                                                                                                                                                                                      SHA-512:ADBB0DD42699DA6D4EDBE21A0FBDAA4C4CBB3F95A1B4B684D5372346D5B06140D786F5134766E2609A8BF32622836A8DDA99CCEAA0299D53AFE4276A6F05DF23
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:owner: Gauzytech.repo: NeatReaderDeskAppPackager.provider: github.updaterCacheDirName: neatreader-updater.publisherName:. - ...............

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25126098
                                                                                                                                                                                      Entropy (8bit):6.535225776771471
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:196608:sEf0O0rZKOquTP0Rj+VbkWdc1ccqV3WKyL6z1Nn8yz9w/2:XnVZ15ybkWdc1ccqV3WKyLQ8yze/2
                                                                                                                                                                                      MD5:FEC1F659221729195F6250A1BC947EDB
                                                                                                                                                                                      SHA1:0CDDDE4C8A3DA8D7B5332023C0F44A21EDB91788
                                                                                                                                                                                      SHA-256:97F8AF682F1ABD9E4F5F9B7CF391FD3310E6BAE793E9F64A170EA583E6663422
                                                                                                                                                                                      SHA-512:804A6049E8A1EEFB04206BECC4F6B441D1A43A40D2CC6B66F6F7F6E27B9E41E23C51AAA966BF6668203A5906F1AEC5A042ACF1E1A1065B3749AF13997DDDC6AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:................{"files":{"LICENSE.md":{"size":6587,"offset":"0"},"README.md":{"size":2610,"offset":"6587"},"electron-main.js":{"size":32448,"offset":"9197"},"notarize.js":{"size":1383,"offset":"41645"},"package.json":{"size":785,"offset":"43028"},"res":{"files":{"dmgbackground.png":{"size":15701,"offset":"43813"},"entitlements.mac.inherit.plist":{"size":425,"offset":"59514"},"fileicon.icns":{"size":8,"offset":"59939"},"fileicon.ico":{"size":1081406,"offset":"59947"},"installer_win.ico":{"size":104510,"offset":"1141353"},"logo.icns":{"size":158095,"offset":"1245863"},"logo.ico":{"size":121806,"offset":"1403958"},"myCert2019.pfx":{"size":5605,"offset":"1525764"},"myCert2021.pfx":{"size":4351,"offset":"1531369"},"......":{"size":253,"offset":"1535720"}}},"build-app":{"files":{"asset-manifest.json":{"size":1946,"offset":"1535973"},"desk.bundle.js":{"size":1446625,"offset":"1537919"},"favicon.ico":{"size":67646,"offset":"2984544"},"index.html":{"size":960,"offset":"3052190"},"m

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\LICENSE

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1061
                                                                                                                                                                                      Entropy (8bit):5.10019973945846
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:JTrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:5aJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                      MD5:04CDC42E6AB6E50D5DBCAEB49E36259D
                                                                                                                                                                                      SHA1:89DE8E53B9D281CC34AF448F63E1205BB6F6716F
                                                                                                                                                                                      SHA-256:DC30C81D5B085C711E1F97F47C8446DA285B67B1415BBD1F4D3231A1A96EA29D
                                                                                                                                                                                      SHA-512:660F0955B4864CA50CC8FB3084EA71A01C4B211D2AA06B320A2136F93D7F36D9B00592602BC6A2EEC0878BD25D7A439650F82C508B428105B602C42242099C04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MIT License..Copyright (c) 2017 oldj..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WIT

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\demo.js

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):185
                                                                                                                                                                                      Entropy (8bit):4.590000335232084
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:UV9weLFEJBPOKaDgDvXbfAzHKLRWiIvFHbGvKlWuFzGLfFFwHbGsHuQMv:UXEbyerfAzHK+vFHKvEhzEYHKwuQMv
                                                                                                                                                                                      MD5:1A159E84E567AD40E95E1D48CBDCF044
                                                                                                                                                                                      SHA1:28DD65A0D76F51EA81EED41C785DCD86B697D5C8
                                                                                                                                                                                      SHA-256:9905E2EB71FBB9C550A49F386C09D8B4988536493EFB20A7E19E926B1AAD4554
                                                                                                                                                                                      SHA-512:0B63F911E5CC5421FFE222AB7564B5A8CCC383AA14AA9307B4CCEA96E5F5C7F9DFBAEFFF3B66671ECC015636ED2EBB46A4B677C1740CE4BB8172D16E97F577AD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/**. * @author oldj. * @blog http://oldj.net. */..'use strict'..require('./index').getFonts(). .then(fonts => {. console.log(fonts). }). .catch(err => {. console.log(err). }).

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\index.js

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):450
                                                                                                                                                                                      Entropy (8bit):4.816462148236487
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:UXEmZ7CrQHzF/ZQq/vF34ZH6yzON4BH6SbIglRbPke:2ExqzF/ZT34H/zQyHJIURLz
                                                                                                                                                                                      MD5:5ECEB0471DD89A13D7665D720A68A0BA
                                                                                                                                                                                      SHA1:5BA17AFCBB9AE32F4C006D6E205D7A9669E5E100
                                                                                                                                                                                      SHA-256:CBC4D927634768FD73576217494C180E0C8D4B58BA72AE4E8FFA36C7714ECE2F
                                                                                                                                                                                      SHA-512:87F1F5E463B74BFAC2526DEEA677695E9A42034FD0604356E934A0B1153B39C871E2BBDFF7737480939E376D6B8DFD8C53075109F53C0D977FBB7B486A9AF97B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/**. * @author oldj. * @blog http://oldj.net. */..'use strict'..const platform = process.platform.const for_darwin = require('./libs/darwin').const for_win32 = require('./libs/win32')..exports.getFonts = () => Promise.resolve().then(() => {. if (platform === 'darwin') {. return for_darwin().. } else if (platform === 'win32') {. return for_win32().. } else {. return Promise.reject(`Error: font-list not support on ${platform}.`). }.}).

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libs\darwin\fontlist

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):18672
                                                                                                                                                                                      Entropy (8bit):1.2513931584657838
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:xmiVaUTy/u/GvpvnQeX25TniFNEw37CDbplM6yX1KqUcNqP2VPtjY2iEa:xmiVV3s5gpsK4NrVkK
                                                                                                                                                                                      MD5:90F82F5F098602106082F346FD5CEC2C
                                                                                                                                                                                      SHA1:4EAF83850764ADD914E42C51CE35632E0BDCC349
                                                                                                                                                                                      SHA-256:117C76F2A1632870577CD182D811F65841BC49C8EE1FD96CCB0CF44395C3D4BF
                                                                                                                                                                                      SHA-512:0FFCB12144CEEF3320C3E3F53CB990CBAD563E5A1F55B39F7C8C9B7B1BD30CEE38D36D25194CCDF7E49E8EFDF83A4604D08890753313846C1C164E6DCBB07BBC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.......................... .........H...__PAGEZERO..........................................................(...__TEXT..........................................................__text..........__TEXT..........@...............@...............................__stubs.........__TEXT..................$.......................................__stub_helper...__TEXT..........0.......L.......0...............................__cstring.......__TEXT..........|...............|...............................__objc_methname.__TEXT..................4.......................................__unwind_info...__TEXT..................H...........................................(...__DATA..........................................................__nl_symbol_ptr.__DATA..........................................................__la_symbol_ptr.__DATA..................0.......................................__cfstring......__DATA..........@....... .......@...............................__objc_imageinfo__DATA..........

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libs\darwin\index.js

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1115
                                                                                                                                                                                      Entropy (8bit):4.64600895990603
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:SP+jRASEBH4+nPRM0+2GbYv1bBPCnLhd5o5w7QvN5kOinH:SPAEx4ORM9OlsISqKOinH
                                                                                                                                                                                      MD5:425F1822F7A5B7162C987630B9512BCD
                                                                                                                                                                                      SHA1:7595E01BFF938738AE1DE75B5BA06C7D41ABFDBD
                                                                                                                                                                                      SHA-256:0424800DCA9635AEBAB1A318E4A4CC00B0D53E86EFF0BD724F1B92F2CD7196E6
                                                                                                                                                                                      SHA-512:EEC25CFD5066B8736FD2C6345B1468A0847DFFC805683501D99C6982B962D73ED43981C3FCA837310319895F40EEDEA8FF67D1C4B5226973276B8AD6F67D4D8D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/**. * index. * @author oldj. * @blog https://oldj.net. */..'use strict'..const path = require('path').const execFile = require('child_process').execFile.const bin = path.join(__dirname, 'fontlist')..const font_exceptions = ['iconfont']..function tryToGetFonts (s) {. let fonts = []. let m = s.match(/\([\s\S]+?\)/). if (m) {. let a = m[0].replace(/\(|\)/g, '').split('\n'). fonts = fonts.concat(a.map(i => {. return i.replace(/^\s+|\s+$/g, '').replace(/\,$/, ''). })). }.. return fonts.}..module.exports = () => new Promise((resolve, reject) => {. execFile(bin, (error, stdout, stderr) => {. if (error) {. reject(error). return. }.. let fonts = []. if (stdout) {. fonts = fonts.concat(tryToGetFonts(stdout)). }. if (stderr) {. fonts = fonts.concat(tryToGetFonts(stderr)). }.. let dict = {}. fonts.map(i => {. if (i) {. dict[i] = 1. }. }). fonts = []. for (let k in dict) {. if (dict.hasOwnProperty(k)

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libs\win32\fonts.vbs

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):663
                                                                                                                                                                                      Entropy (8bit):4.769055573454181
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:4fjaQNv1nCBgqpKEITKEYwAuRlYiqveAxKRGHjY:4f+QNvt/q0EqKEYwAElYiqveAxKGHjY
                                                                                                                                                                                      MD5:535E7E4E7C659BE25CAC9E936FD60FE2
                                                                                                                                                                                      SHA1:EB8D0BAD0EBC651BA435468253A74B927228A919
                                                                                                                                                                                      SHA-256:A292B00EFD2AD22A57900886065EB2DBA008F526C3B3B161D44F7C620667241D
                                                                                                                                                                                      SHA-512:FBEB119453ED0786B3DAD3D529A60DC6ED8FC96F1E4A62AA6AC522969FCF017AC53F1CF998C93CB400FB5EB02E027686C55B4FAD8400EAD522A3E4C01833EF53
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:Option Explicit..Dim objShell, objFSO, objFile, objFolder.Dim objFolderItem, colItems, objFont.Dim strFileName...Const FONTS = &H14& ' Fonts Folder..' Instantiate Objects.Set objShell = CreateObject("Shell.Application").Set objFolder = objShell.Namespace(FONTS).Set objFolderItem = objFolder.Self.Set colItems = objFolder.Items.Set objFSO = CreateObject("Scripting.FileSystemObject")..For Each objFont in colItems. WScript.StdOut.WriteLine(objFont.Path & vbtab & objFont.Name).Next..Set objShell = nothing.Set objFile = nothing.Set objFolder = nothing.Set objFolderItem = nothing.Set colItems = nothing.Set objFont = nothing.Set objFSO = nothing..wscript.quit.

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\libs\win32\index.js

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1343
                                                                                                                                                                                      Entropy (8bit):4.822997476682633
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:SP+BRAiF/ekxAUtovF12v8TemDBPC2KE+FuaCeigtQdec87BOtH:SPedewBiLi8KmDIEQuYbT7BOtH
                                                                                                                                                                                      MD5:17581571CEE41DAC6A45B03321197F0E
                                                                                                                                                                                      SHA1:82C1743AE4002AF4901D3E3F5B02DD773FBCBD12
                                                                                                                                                                                      SHA-256:53EE13B13161F7D0BDA392DB251B7ECDC4ECFA127A76E46EC3CC01A25426B964
                                                                                                                                                                                      SHA-512:BD009381E248AD85CCA9367B67ADB97DF53454A850F9F7394713B97CDD10CF649377E22263D9E35F7AD7A652B206FD58DE4B82DC282FE241F5D42EADA7804E7E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/**. * index. * @author oldj. * @blog https://oldj.net. */..'use strict'..const path = require('path').const exec = require('child_process').exec..function tryToGetFonts (s) {. let a = s.split('\n'). if (a[0].includes('Microsoft')) {. a.splice(0, 3). }.. a = a.map(i => {. i = i. .split('\t')[0]. .split(path.sep). i = i[i.length - 1].. if (!i.match(/^[\w\s]+$/)) {. i = ''. }.. i = i. .replace(/^\s+|\s+$/g, ''). .replace(/(Regular|..)$/i, ''). .replace(/^\s+|\s+$/g, '').. if (i.includes(' ')) {. i = `"${i}"`. }.. return i. }).. return a.filter(i => i).}..module.exports = () => new Promise((resolve, reject) => {. let fn = path.join(__dirname, 'fonts.vbs'). //let c = fs.readFileSync(path.join('for_win', 'fonts.vbs'), 'utf-8'). //fs.writeFileSync(fn, c, 'utf-8').. let cmd = `cscript "${fn}"`. exec(cmd, (err, stdout, stderr) => {. let fonts = [].. if (err) {. reject(err). return. }.. if (stdout

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\app.asar.unpacked\node_modules\font-list\package.json

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):353
                                                                                                                                                                                      Entropy (8bit):4.60125646845405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:q/OmcnyI2HxE79/Zc3xsJonI7EFM3oc67OO6GBzM/Ly+T6z6sJonI7yJnqS1W:TsHxE7BKsegsI6aVGBzMbmWseguV1W
                                                                                                                                                                                      MD5:85560E6AD13034B0E28169BD3432243D
                                                                                                                                                                                      SHA1:BEA79471C8FC0978284D355A9134845C215941D0
                                                                                                                                                                                      SHA-256:B3CC2EAB6C0942252FB88457B1F5E73AEC0E09CB6A226BC9003385237D023D6E
                                                                                                                                                                                      SHA-512:B6D52552E3693633CEEE744287FD1FBE27FC479A9B2A69BAEBEE28F06D79BF0907CCC1EBE1D847B096E4640141D20E3BCF057CBC97068B7EA7D843BC3F2CD791
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:{. "author": {. "name": "oldj". },. "deprecated": false,. "description": "list system fonts",. "homepage": "https://github.com/oldj/node-font-list#readme",. "license": "MIT",. "main": "index.js",. "name": "font-list",. "repository": {. "type": "git",. "url": "git+https://github.com/oldj/node-font-list.git". },. "version": "1.1.0".}

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\resources\elevate.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):126384
                                                                                                                                                                                      Entropy (8bit):6.730823060228504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:lVbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlDg+9cgVAS:HPrwRhte1XsE1lDgycgV7
                                                                                                                                                                                      MD5:10809BE421D4374705AF579B40D5A8B6
                                                                                                                                                                                      SHA1:01F50BD18E0C8A73ED18B2FFC0762D83D3765FC0
                                                                                                                                                                                      SHA-256:40DCCB7D21EF1A6C6A6983DCB26DF03DB91FE149ECFC9FED1FA52F3B707A4E23
                                                                                                                                                                                      SHA-512:154DBA012979F124AA3255FB405C9736A852F56FF446F6DEE3999DF32ED6F160FC8740E53E1F599D182DA74B39C4FBC74D26D6BEE2A2177546028AF19083B052
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x................I......T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\snapshot_blob.bin

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):48494
                                                                                                                                                                                      Entropy (8bit):7.9893942456255695
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:XnU1/CJykNENv/4xC5TiD/ESI4gOSv0k849y6vQ8xiOhw+qfroloGdUDgaebDSHN:X8CxMvSUiD/JI2Sv0p49YN/eOD4bDU+s
                                                                                                                                                                                      MD5:BD6D735F6707806E22433F524406EEEE
                                                                                                                                                                                      SHA1:991DFB6D847663F16636ABC908B2BB95C83B5BFD
                                                                                                                                                                                      SHA-256:51943B85CCB0FE6F0749B64840A6827B4F895B10BE4529C2054847EE8CCC5EBB
                                                                                                                                                                                      SHA-512:E88F8366D32D2D3E197FDAE5F417C67825304AA00AA30826C3A3E70C55A61CFC3D9FA2D20F7839478C4F90F3D68D84A58CB5970F7017B87C96AE0EA959DC3911
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.........m.9.1.269.28-electron.0............................................X..........{\\...g.....$!.6.`EK*1IE...Q<!.IP.fB&.(.K*ii..+FlP..-m.V<b.-.i.*V.x...X.S.....+....{``.......{...g.........6V..._.E..FEE..s...E..c%*...&4.M.y.~k..}.....V..7(+.h....m.......>.m......?.3...Z..C...A.....Y.n0...u...._.......B....v.g....-._..V......RUuI.........6^..*Jt.NK..0...\r.!..%G..r.......e....k..|d.W.{.B..f....QQ.J.e9.....dG.....M;.G.%...L.n`w<6..........g...(......?......V.TD../..+...p:.......|\.......;p...N..>....._..8..q+..N|.....1~.(......o.8..O..<....^.k.3.....{...AQ`S....>.....$)HV.. UA..t...d(.T.. [A..\.y....((T.W.P.TP..BA..Z.u...4(hT..YA..V.m....U..SA..n.=.z..).W0.`P...c....(8.`T...q...&.L).V.X`....,.Y.`A..I.$[.bA..i..[....2-. ...r-. ....-.[.. hA.....XPkA....4X.hA.....X.jA........N..,..^..,.`..A..,8f...#...`.1..-..`.)..-P..Y.+\V..H.".$+..H.".4+.XgE...VdY.mE...V.Y.oE...V...X.....+j.....z+..h...f+Z.h...v+.Z.aE..]Vt[.cE..}V.[1`..CV..b..

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\swiftshader\libEGL.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):375296
                                                                                                                                                                                      Entropy (8bit):6.569398699780301
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r0q9ThOMhidEqD5VNoQlFje8+ki4dlM8NEkqZCC9uZaWprSfd9ewO/5i0:j9CNoQbe8+ki4dLC1uZawLhY0
                                                                                                                                                                                      MD5:875845164505BC563F8C188440E2B178
                                                                                                                                                                                      SHA1:2BDE0941D65C9B85E7ED72714842ADB8B43C9294
                                                                                                                                                                                      SHA-256:3851FE0E6938424C964627276C926CF362BF5BBCB5C83276DD3EC3C3BB056C6A
                                                                                                                                                                                      SHA-512:50A734BC005C58777C4B564541027CCBA36E9477A9463F7E21DA617D06E426CD4D300CC67339475F0EB116CDE4A38FF6ED57EC4A579C45CE12845BF1ABEB0BC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."!.....X...\...............................................0............@A.........................7.......=..P................................8...+.......................*......H................>...............................text...>V.......X.................. ..`.rdata..|....p.......\..............@..@.data....4...p.......V..............@....00cfg...............t..............@..@.tls.................v..............@....voltbl..............x...................rsrc................z..............@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\swiftshader\libGLESv2.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2839040
                                                                                                                                                                                      Entropy (8bit):6.771436357855
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:t5UizaF2YKr1TPlFLWQ46F+JQVR58xyLERmIKTk9mUVJAsQG7ethexvi0URr+zOH:tOSaprTxcJnOguZ127
                                                                                                                                                                                      MD5:94833E7539BF5256CC11F6D9CECAFB90
                                                                                                                                                                                      SHA1:DE07A1C9F55671D55701D2667607E8BC98A0C0A8
                                                                                                                                                                                      SHA-256:CDF5F26C30B6AAF164EF6C1C1502A929613EF87D548E15E753CE70E7D4D2DCA1
                                                                                                                                                                                      SHA-512:09E56F76D4F932BC50847EC5F7E7016FBF7D3127466274B8A51EEAEBC653384EDAF0EADA768F3BE75DFB133E114F499806E9E6F80E633CD55B5E238C1802ACE4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."!......&..<........"......................................p0...........@A........................l.).. ..a.).d.... /......................0/.40..<.).....................@.).....X0&...............).P............................text...s.&.......&................. ..`.rdata..D.... &.......&.............@..@.data.........*.......).............@....00cfg................*.............@..@.tls........../.......*.............@....voltbl.O...../.......*..................rsrc........ /.......*.............@..@.reloc..40...0/..2... *.............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\uninstallerIcon.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):121806
                                                                                                                                                                                      Entropy (8bit):5.067418679247204
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:XwCkIMi7aTvUAOy2s16wz1/+Jv3n5ydricOjmJUwZmjx681/uV81prFB6FMv:MIVGTc4F+CYjmmwZmjxi+bqFm
                                                                                                                                                                                      MD5:F5B33964F35D20C8EFFC0863709F9E1D
                                                                                                                                                                                      SHA1:79DAF111FA7A6B06787039C64259A30F43AFEB28
                                                                                                                                                                                      SHA-256:AB5A5C17355115D1B627579BC7E05E3E5F930F824D4D8A103110C77F991D036D
                                                                                                                                                                                      SHA-512:848EACE5BD55A1FD848077695AD19D9639F6EA74FB316415EF6CA2D5710CBEBC7189FF3ABD67C759FA8FAB3AF924D7B5805EDD5CB65CEE6A325C945C1FCFC54A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............ .`V..f......... .(....V..@@.... .(B...^..00.... ..%...... .... ............... .h...f....PNG........IHDR.............\r.f..V'IDATx..y..W}...Zz.f.,.h...%![.16^..CBH..!.......K..&d...&..'....'....!!.[,......h$.....k9....gz...S.=.T..4]}..S.}...;K..<x.......<x.......<x.......<x.......d./..?FGG..#.D...l.-.......<k...P....5.........u.x..'.....+........1...........A.....$.[......sf.1.1.QUu.1...f........2..!$. . .@..Hx.....:A...(.;...@.(...Ph.....$._..M. ..A..E.L....u=C)].u}I..)M.&.E..f.#..M.B..,.B.(...O...<.X#T.^.......`...........].,o.E.O..86..b..'5M.PUu.X,..f...E..`...4!..O.....A]....-........`(..9.......1...........b.x6..>..fO.B..!.(.B9..O.V.......%.L.n..eY...F.....}>..A.bk}.k.].S.../...&...TU=O....(.B.F........6.0.%..u........H.@ pP..!xu_..(.X.Px6.J.$..=G..B..'...!....^#l...(E.{.l.../..b.....$...5n$..:.........B..!... ..PO.Z.O...a...:.l.$i.".xE0..K..k}}...E.....[XX...i'..AZ....U..<.p...~.@..].h..h4....?@......G0.|>.<.L~7.J...2J.....H.........f~...Q..vt

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\v8_context_snapshot.bin

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165672
                                                                                                                                                                                      Entropy (8bit):7.993838196016534
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:3072:JGafMxPyq/OT/eCIceqeNX8FI6cQVMPfKjWkKyBhmED/mScpJeWg8:JGbfmqC5equ8uIVMPfKjtnvX/mSc2G
                                                                                                                                                                                      MD5:16A6F859B06AB90F638C55C74E74B109
                                                                                                                                                                                      SHA1:3C423CCB509B7552C3F1B4589CF1B8A25DE0A1F1
                                                                                                                                                                                      SHA-256:F28E75DA2CFBAF8AEB069873048CDC604AD70D32FBAC3D8C9D7DC2BD5F9C1734
                                                                                                                                                                                      SHA-512:0784EE049ADB2A7034E6627C15C8F58532E0A6A5FDFC9A48C56038E26FD4429318A9F3B4EACCBC778AE374DD2F0FA9079933383E81CA54C3FA5666EAD97ED179
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.........8..9.1.269.28-electron.0...........................................A'..6`......(..........M.....s.:..s.L..#."..F.gdd.......c.g....0.B(..P.....F..(.".KQ.7.E.(%}.Z.^k............Kg?..Y.~.Z...{...~.^'...Z.j.....S...o....V-......6..........u0.Q0`i2.6....R.CRA..|^.ZA"..6..D....i#..?. ?LQ..|$.... ..S*..L.....?.VPh.<...;M.y..a..B....RZ.-NMM.l.Z...)...{...b.4.Jo....re..K..%sS_#?Y...s..Z...@+....^.'..Y\.7.#..5.Rwpnp.|3.es.?./..o....O..r.H...R.v*...........?.7.........?...'\..............&.9j.nG..]...........@4.=.F.RT...%.84.MF...i4.-@...r.2Z.j..h.z......F....0./..}..@_.o.w...3..]G...mA.......oA.,..........:XP'..jA.-....XP...YP.......4...$YP.*,h..%-..&Z....nA3-h.........Z...ZeAk-h..m......vZ.n..kA.-.....c.t.NY...:gA.-..]..+.t... ..."dEn+.YQ....FV..ZXQk+jkE.....u...V..r.(.....Y.P+.fEA+..(dE.V4..VTmE..h..M...V4..Y.B+ZlEK.h......V...6[.V+.nE;.h....Vt..X.1+:aE........Vt..[..+.fE.X.%..NA(..S./.e...).Q.j..Z...).m..:...).{..rRPn..KA.)hP.

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\vk_swiftshader.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4064256
                                                                                                                                                                                      Entropy (8bit):6.632718906424881
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:JZBSYJdRLwAb4slfLIjNFSdahJ3e6s0+iFtNwlPga5+YZLYwdNOKvkVfjiNHVmOh:msdbNMOk/wZntF94wg6fN
                                                                                                                                                                                      MD5:6EFC3DD2EF157E156A327976786F5AF9
                                                                                                                                                                                      SHA1:D65231C36D8AD72835DB584693C4AF887BE71B46
                                                                                                                                                                                      SHA-256:2E93213501DC4F1C0B9AF612AECAF6D94A11DA934CEEA1E1689EBB95623EB518
                                                                                                                                                                                      SHA-512:578D620DC6772B5FA9D733E34D965D6C0868035226CB85800C38329F91C26B96A3D9A85255765E01BC7887D416E16E30D14216A4BDCED08CBDC488004E75B3CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."!.....*3.........p./......................................PC...........@A........................x.;.G.....<.P.....A.......................A.|.....;.......................;.....HP3.............8.<.(............................text....(3......*3................. ..`.rdata.......@3.......3.............@..@.data........P<.."...0<.............@....00cfg.......`A......R<.............@..@.tls....%....pA......T<.............@....voltbl.......A......V<..................rsrc.........A......X<.............@..@.reloc..|.....A......^<.............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\vk_swiftshader_icd.json

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):106
                                                                                                                                                                                      Entropy (8bit):4.724752649036734
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                      MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                      SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                      SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                      SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                      C:\Program Files (x86)\NeatReader\vulkan-1.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):630784
                                                                                                                                                                                      Entropy (8bit):6.720686568637708
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Kj75fGWAhFBHEQJ6naq5vdcqrf4hNQGryua85rcvQUvVjsq:M5fpNBrfw3r/Av
                                                                                                                                                                                      MD5:2E7229E30D58C2DB4149C8CEEE8E9FF6
                                                                                                                                                                                      SHA1:E9729C235B3BBFB459AA7CAA7E8DC3ED061696DF
                                                                                                                                                                                      SHA-256:DB35E7EBA7214348098D866B6F97B8CA3837DB751DBD831A095FE3EA1C6B68DF
                                                                                                                                                                                      SHA-512:06A0397EFA8BEADD267DD7E91D0DD0036483415834ED6AEE4FAFCB8D0EA5044859B90E3D172F98BF955BB137A3BCF1D37D7FC3809E170E692FD71E4B1DBCF844
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6.`.........."!......................................................................@A........................4...N.......P................................\..................................H................................................text...~........................... ..`.rdata..,0.......2..................@..@.data....4...@....... ..............@....00cfg...............<..............@..@.tls.................>..............@....voltbl.0............@...................reloc...\.......^...B..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\SpiderBanner.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):9216
                                                                                                                                                                                      Entropy (8bit):5.5347224014600345
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                                                      MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                                                      SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                                                      SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                                                      SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\StdUtils.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):102400
                                                                                                                                                                                      Entropy (8bit):6.729923587623207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                                                      MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                                                      SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                                                      SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                                                      SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\System.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12288
                                                                                                                                                                                      Entropy (8bit):5.719859767584478
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                      MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                      SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                      SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                      SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\app-32.7z

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61741847
                                                                                                                                                                                      Entropy (8bit):7.999994280392845
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:786432:+3CxVBpYrPQHNaeGPO7QVg+ARNHrC8NTiD8Bk09DeIyTqEO1nbFli8J+VFTfHGde:Pqs0X+Qu+eWU+gDea7iSYfmuwpHc
                                                                                                                                                                                      MD5:7C0BED70F849857509B58B28E6373235
                                                                                                                                                                                      SHA1:3C102ADB83E8F7306307EC837E4C7DECCEDB6122
                                                                                                                                                                                      SHA-256:1FA2BB851EA86BFF1838B2C2AF6BD0AB3177D71B9C06BBC2F08A40D3B9C84992
                                                                                                                                                                                      SHA-512:F77BF85CD85F1457977CAB5C448A638400D1D368FB90C3E3BF1192071BA4E6E4ED523233F80A8F28C51CC9D66624E6D6F15D9DC59F18D75AF5ECD2A84E085F30
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:7z..'...+.a.........%.......s./f....]...6.........y......{c..qRl........o1....m.`.].J..Kq.../lwo....0{L.L...../w...3.C....l)./..{..)..6....F....v....J.+...6^.f#.4....:G./.(.m.C5.....+...aW.n..Fj..Q8...r..Q....\..rC~.....@.....r..B.E8...0..C......=K6..f....m.*S.r.J.me..*....8.ub..Z(4...|.;s..s.gy............Ws)8.e(...Gu.s.U;'.e.O*..`.b.....=...%|..w....1pY..(.'-...kQY....-.{..y.I..964..<.d?.Q...j....3P.......i...<0r.96OqFz.........pFf...Z.=.*.,..gZ.....k...}1..W.......C.Ct....oc_.v~;.mm.oF..r...w.d.N......1\....l8(L:...K./...=U.Ey............U......u.f_..c.3W...F.....g.es.B.nX..hZ...."..H...C..8.(pJ....H.Y&fu.0.#...I........r.bF.....K...+.Y...:=B.8.......m=7...n*.X......_Wc....ZL>......r...;...j&...#.IP.r..}.GQ...p.V...7..#\.$...<%+E.fW.~..'....:.T........e..LF@.-..H.[ZR.`.{8.,x..f.k.....V.'.8#bg.'"j..&.)....e..B.[.9..R.Y.....2.A^.........5:....:3..........7.....E.(#......."^}cj..Z~..3.v#.j.z..'.....8..._.+=....|A..8.

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsProcess.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4608
                                                                                                                                                                                      Entropy (8bit):4.703695912299512
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
                                                                                                                                                                                      MD5:F0438A894F3A7E01A4AAE8D1B5DD0289
                                                                                                                                                                                      SHA1:B058E3FCFB7B550041DA16BF10D8837024C38BF6
                                                                                                                                                                                      SHA-256:30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
                                                                                                                                                                                      SHA-512:F91FCEA19CBDDF8086AFFCB63FE599DC2B36351FC81AC144F58A80A524043DDEAA3943F36C86EBAE45DD82E8FAF622EA7B7C9B776E74C54B93DF2963CFE66CC7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n}f.L...I...P...@..K...@..H...@..H...RichI...........................PE..L...\..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..|.................................................... ..d............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsk2BFF.tmp\nsis7z.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):434176
                                                                                                                                                                                      Entropy (8bit):6.584811966667578
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                      MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                      SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                      SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                      SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 17:03:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2677
                                                                                                                                                                                      Entropy (8bit):3.98062114134276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:8MTdhTJNxHoidAKZdA19ehwiZUklqehQy+3:8Mf/w/y
                                                                                                                                                                                      MD5:B97018DEA60B9DC71A2ACB36D48DC073
                                                                                                                                                                                      SHA1:1AC66E5978D791252D3B73E6342B6BC0208EC03F
                                                                                                                                                                                      SHA-256:3BB69F9248EA084175502CEFF53A9DF0362AF5488ABA6C9D3DFAFAF1068A1433
                                                                                                                                                                                      SHA-512:EFEBBCE659C6DD870942E5AD024B49D5C1F453CC95D2E306CB8FC940F060F62926808F18B96CDDAF2A3EB153924D66FAF1C178F901EAB17DC255D03A3B56BCB2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:L..................F.@.. ...$+.,.....7.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I<Yq.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V<Yq.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V<Yq.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V<Yq............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V<Ys............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ma......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 17:03:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2679
                                                                                                                                                                                      Entropy (8bit):3.996552646236307
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:8CTdhTJNxHoidAKZdA1weh/iZUkAQkqehvy+2:8Cf/K9QWy
                                                                                                                                                                                      MD5:A9D6CE99C13D6F4C961055036BD56385
                                                                                                                                                                                      SHA1:211BE28720519A94ABCD24A61A386E7B6C3EBD0A
                                                                                                                                                                                      SHA-256:D6ECC87A9D50D717EA010437D771DECA25793C77C66211BE4DCF9260DFDC60D4
                                                                                                                                                                                      SHA-512:9E656C8E49ED2026670C50EA2B8EBFB70C4BD3B7F07229FB8B5944A124190E46AEE90B0851364394EDC5CD37ECC9834160AF3DC5EBF341DD5719F7E532FA549E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I<Yq.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V<Yq.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V<Yq.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V<Yq............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V<Ys............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ma......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2693
                                                                                                                                                                                      Entropy (8bit):4.008380639258225
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:8xudhTJNsHoidAKZdA14tseh7sFiZUkmgqeh7sdy+BX:8xw/VnLy
                                                                                                                                                                                      MD5:AAFEDFABA865480FA738EC226C559AAD
                                                                                                                                                                                      SHA1:73B4B57BA0351F3F61A0F8A9901CE18E6D3AA7D0
                                                                                                                                                                                      SHA-256:514119EC8173ED9B42C553B1A6A327ACFAEB4EBFEE81B376BCAF78AAD5912A05
                                                                                                                                                                                      SHA-512:038504DD85CF9669D7D8D5FA106B47914D5A64C2F70B973908F95E68C1EE857D9D875DE382C52455DE08331A93312D6EA71A790841AFD9BD50ECC45F022EBDA8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I<Yq.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V<Yq.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V<Yq.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V<Yq............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ma......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 17:03:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2681
                                                                                                                                                                                      Entropy (8bit):3.9967447518192745
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:8ATdhTJNxHoidAKZdA1vehDiZUkwqehjy+R:8Af/RVy
                                                                                                                                                                                      MD5:E64F0253EC575C659B8FC18943379440
                                                                                                                                                                                      SHA1:D5258FB05218B32B8A1D8370FFCB88876436D7EF
                                                                                                                                                                                      SHA-256:22E300CFA5989126891228918E6D3EE9EE0722BA4F746029C85ACC90A730EAFD
                                                                                                                                                                                      SHA-512:9D4A9229972D1EA2D865646AF491BC8C3B011E2837EB2215E1C864EA1B33E732EE9AE17B94C073000866B704B8E3C4473CAA796C0CB86100C830E402B6945046
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:L..................F.@.. ...$+.,.....)......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I<Yq.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V<Yq.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V<Yq.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V<Yq............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V<Ys............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ma......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 17:03:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2681
                                                                                                                                                                                      Entropy (8bit):3.986679904329493
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:8yTdhTJNxHoidAKZdA1hehBiZUk1W1qehJy+C:8yf/x9py
                                                                                                                                                                                      MD5:0F8427ABA3B6E7E4C000F467AFA1E240
                                                                                                                                                                                      SHA1:A97F8E63FC88E22920EECE709FCA20421F01F248
                                                                                                                                                                                      SHA-256:ADC16CE6328D9EA6FF5D69BB515BBE22C536C71A11EDE6ABCF6A163E0095DE63
                                                                                                                                                                                      SHA-512:7BB54E94BCDBFACCF381E4DC4ADB7E1E6EB528ED4D085CEB1069536595530A3420109B8FA06E5C22EA5956CCBD6A4FBA2F75E371506DA3B79B1ABB848E4D6826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I<Yq.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V<Yq.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V<Yq.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V<Yq............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V<Ys............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ma......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 17:03:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2683
                                                                                                                                                                                      Entropy (8bit):3.9934003739461965
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:8RTdhTJNxHoidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8Rf/tT/TbxWOvTbLy7T
                                                                                                                                                                                      MD5:96F67FDB46E0422C4FBE1B8F48373952
                                                                                                                                                                                      SHA1:FA13A0C79F0E97F0853E6DB1C558DBF9D7DCA009
                                                                                                                                                                                      SHA-256:9BB2CBCF2657234AA5491E034D864306599EE556C33271569853B4ADF44FDA62
                                                                                                                                                                                      SHA-512:0D4A0436A8E64550675F32F4B14867755B46112FBE60C12A20705BEF94B919E851845F91EF73F2A000FC1043E042838B821946DD7E2B22FDA3BA4277DB5C6000
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:L..................F.@.. ...$+.,.....y......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I<Yq.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V<Yq.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V<Yq.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V<Yq............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V<Ys............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ma......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                      C:\Users\user\Downloads\5f76730b-09b4-44db-ab17-a9dd86f74506.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3618
                                                                                                                                                                                      Entropy (8bit):5.651491323181245
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:SkhS8e8bpeErO5xOgirB5FWXj4Eqwmpj+gvkxTZ9v7UcyLPPe3C4Sg:zS8xlgil5Y0lVA9ijMxSg
                                                                                                                                                                                      MD5:E18C5E90F03C33BE42CA1E672A3E2691
                                                                                                                                                                                      SHA1:E4D67ADDE82308156865255B1CD3CCB6F7B0B0C4
                                                                                                                                                                                      SHA-256:E7650623F19569F7B833FF17C22906E4DAE3AE87356D3DB77909CD7112384C66
                                                                                                                                                                                      SHA-512:B66EFBDA4BB05B287DF55660328710351715AC7557CEB7303B8A3EE438E7C7BF152356D933E82C14BB8F84D17A6779BAB0E1951A84CFC6AC65931A481ACD24F9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@..........................p............@..........................................p..............h....I...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\Downloads\684586ff-cd85-441d-9787-5fb9ae2d80f4.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15906
                                                                                                                                                                                      Entropy (8bit):6.276661666099353
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:vxvDHkhvUCWoofU+H81t6G3d/ZI5b93Y+gsj+HFQchF1zu:vxr+nWI+c1t64d/ZuFvg0Y9v1zu
                                                                                                                                                                                      MD5:26D170B40D1CBDB5E8EC96C14B1AA399
                                                                                                                                                                                      SHA1:35E07232AFDA74B6F165A28950E8E37AE593C5DF
                                                                                                                                                                                      SHA-256:BE63214551BA11684C372F0E41C4CDECF4F984FCFC23342B0B12F4E2DB913786
                                                                                                                                                                                      SHA-512:8F5ED8CEB67E053EE7645D9535400A835D10DA470991AB52D26CDB48753A0CF1B0C1F125E5536E62AACBCB8F7EA5305D00BE317D2443181073CD8F85684553A0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@..........................p............@..........................................p..............h....I...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):62455064
                                                                                                                                                                                      Entropy (8bit):7.999814754145496
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:786432:3y3CxVBpYrPQHNaeGPO7QVg+ARNHrC8NTiD8Bk09DeIyTqEO1nbFli8J+VFTfHG+:3zqs0X+Qu+eWU+gDea7iSYfmuwpH+/
                                                                                                                                                                                      MD5:DEF17C832C3E8169A69D3E854193F59B
                                                                                                                                                                                      SHA1:9C0A89EA5F757E411B04CD39CAE2EE77F1EA3093
                                                                                                                                                                                      SHA-256:CCDC54FC8400B225B46216F3172A57433B99E78F3ACB7DF4FF7D4B7AB56327DE
                                                                                                                                                                                      SHA-512:BAE92FE973C76945A1D73F86C56EE5E832942FE640D786199D19111000520B12DC9F5DD2F531DFAB62C809AECFEE0D3B151D7E7C8674D463D4AD64DC7EA9F38D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@..........................p............@..........................................p..............h....I...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\Downloads\Unconfirmed 299717.crdownload

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):62455064
                                                                                                                                                                                      Entropy (8bit):7.999814754145496
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:786432:3y3CxVBpYrPQHNaeGPO7QVg+ARNHrC8NTiD8Bk09DeIyTqEO1nbFli8J+VFTfHG+:3zqs0X+Qu+eWU+gDea7iSYfmuwpH+/
                                                                                                                                                                                      MD5:DEF17C832C3E8169A69D3E854193F59B
                                                                                                                                                                                      SHA1:9C0A89EA5F757E411B04CD39CAE2EE77F1EA3093
                                                                                                                                                                                      SHA-256:CCDC54FC8400B225B46216F3172A57433B99E78F3ACB7DF4FF7D4B7AB56327DE
                                                                                                                                                                                      SHA-512:BAE92FE973C76945A1D73F86C56EE5E832942FE640D786199D19111000520B12DC9F5DD2F531DFAB62C809AECFEE0D3B151D7E7C8674D463D4AD64DC7EA9F38D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@..........................p............@..........................................p..............h....I...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\Downloads\Unconfirmed 708013.crdownload

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):62455064
                                                                                                                                                                                      Entropy (8bit):7.999814754145496
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:786432:3y3CxVBpYrPQHNaeGPO7QVg+ARNHrC8NTiD8Bk09DeIyTqEO1nbFli8J+VFTfHG+:3zqs0X+Qu+eWU+gDea7iSYfmuwpH+/
                                                                                                                                                                                      MD5:DEF17C832C3E8169A69D3E854193F59B
                                                                                                                                                                                      SHA1:9C0A89EA5F757E411B04CD39CAE2EE77F1EA3093
                                                                                                                                                                                      SHA-256:CCDC54FC8400B225B46216F3172A57433B99E78F3ACB7DF4FF7D4B7AB56327DE
                                                                                                                                                                                      SHA-512:BAE92FE973C76945A1D73F86C56EE5E832942FE640D786199D19111000520B12DC9F5DD2F531DFAB62C809AECFEE0D3B151D7E7C8674D463D4AD64DC7EA9F38D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@..........................p............@..........................................p..............h....I...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      Chrome Cache Entry: 289

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3320
                                                                                                                                                                                      Entropy (8bit):7.814761165838013
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:bCyYFFhat3c8/SkfmBf9SErgi3NHY1yaaXCgjFw1rz:RYFFANcSSkfmBMErt4aywC
                                                                                                                                                                                      MD5:A1B22D82FD016445A776F6B20E14F11B
                                                                                                                                                                                      SHA1:D91EEEE7C20FD5F815761FA845FBE602A4969029
                                                                                                                                                                                      SHA-256:6A1EFD2A5CF4E8846F8B6E5DAA0D14640A70AEC665CF0A7AA549B1BCA55E7D81
                                                                                                                                                                                      SHA-512:7836B98E0D81CCCD42BDAE114ADE830CE717BC4741355CC53E75069B9C64CDF1764EE6E3EF0BAEFAB3BF1477B721085075A61F42CCE1F97632F2341030BD3E47
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/iOS.png
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD..............IDATx...ypU...p.(....?j.)3..3./... `..B..... `e....P[E.L.Ge.#...Zp..$BHH.!..e.[. ..ID...&..~......w..m.7..%a....s..C..E..-Z.h.E..-Z.h....hh!...2><<....-xn.......M0.....U.3AB.3~.9a..q...Ihd...A..|.|..M..!."o..9.....`..1..<.b{~................s......ADK".~..x..). .C..).............31bn."v.CJ.C..@|B..9.....i..........*....,.^x!*W...;w....?$|........m..Q......x&.H" ^.'GD..Q..I.......y..U.e.6...{....Y.@...Y.gB.$..cXD......,.......y.(<|^A...g@...z..Y.=N.0..&ALr....tK.UJL..8.. d@1.Y.xh.$..B...h:J.$ZR. '`.O...[%..u....$^...R... .B.I0.B./ n.....P.'; .X..Y.R..1.........6..... sp!yV..C*B..o<J...%.........(.%".R....V...R...D._....2...QD!...)...w....."@..*.B.....G.H.@.x....R.F....B..j.....$#6..H..Ol......). .i.. y.h.!. ...)w.I.MiH...P..".HI~9.. ..U8...W...G.!. d@i.N..".!y2.u.4........tF.$....F..H... %.Y.9..y..7..7....P.(".H.^B..F..!.J..U:.T.t.........?OlfH....Y1H...@2bCr.h. ..I..W...F[.$wb#@.2..t.'..

                                                                                                                                                                                      Chrome Cache Entry: 290

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37658
                                                                                                                                                                                      Entropy (8bit):7.994897732347311
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:TcLp/YW4i3iSAv1E9R6rYhOsr+yP/xImd8BIB01iP8mks18VK4y5:AGsFAvwgrjYNPqmhua0K46
                                                                                                                                                                                      MD5:7090B63ACBEC7EE45513BDDC66AD4830
                                                                                                                                                                                      SHA1:08DC4311CA095FEA0628CC8A8123DE300C6F084D
                                                                                                                                                                                      SHA-256:41799BFEFFBEFD1B0A4EFC6AFB98EB7BCFC96319A00DC81A9896942738ADDC2B
                                                                                                                                                                                      SHA-512:59CDDAFDFE470FBAE2D08B1DEADADA9CAAAAC576B5E06797A82E4B65FADCE9B845EB9F89F87FBCB632E39AD79774B939E16D710D145769AE3726F8BEF663C6C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."..j.@.D.5x.C....#. DH..3,..g.. ...>p....>..k...|W./5.......W.............../..'......J~...{..........o....._..z=.?......Y...%...k....?./l................4?U.s..w...q.S./7}.}#..........!.#......}..._..............{......?....9.#...............}d.C.............?........?./.............O............#.....?n..}K...............E.g......g.....?._.??.;.0|..Uy..m.u.W..{..9"c...sl....(..&....N..f.....X.rXu.L?m.Z.z......bt.sO.R.9......;...K=[Q?...e...T=z)..D/..L6..Z.........X5Y..1...ir}.T../.,J.F..Z..x,;..YZ...,...\.d4..}...n...s....(...z...D.G.j.Qo..0...u.%Zp......K.......!..(..Ew...S...)EVP.*].....y[..!.K5.Y ..T....'....G...`.h....4.z.d.5[<.".#.#...;..#.y.....f....c.....ZW..."...U..#....\<n?.{b....{..qQ..B.'.O$v...L$^h.U..........Rc...6....^4EwC.`>r2.C%.oBL|eG....[.Z..F.e.....ov.J.[O.\..Q".....!..5.....3../A.k./X.:L..5..e2....?%...?/e...,...D.IJ..gs....z.............P$.Jw..T.......ra..).../.._f8.h.\....

                                                                                                                                                                                      Chrome Cache Entry: 291

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):37288
                                                                                                                                                                                      Entropy (8bit):7.994762848094783
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:UQSzY+QT8ixHcLcMPO0iDX5nGViyewu06tKiCMSrCgTFEbg:UQSzJQCLcMPO9X5nGViyej0dph
                                                                                                                                                                                      MD5:156C2C8098F1F956D43EF04E6FC6DFF4
                                                                                                                                                                                      SHA1:5844EF40E7C70C89F8B30E94E3EF7DE57F37BBD8
                                                                                                                                                                                      SHA-256:5A79395E0FA29B172E332D0600B70A3B90D36C425421C16F514D087B50829571
                                                                                                                                                                                      SHA-512:E0722ECA4C570C68D21739F407FC18E5FC3695DA344516EDBAF226FC250F1B989B6B34C2A132D6EB95CC1FD8F04D757E277DC104931C98C988ABA495FA00DA49
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/0T39vSkEFpnjfJ-ZAC7jQ3vHbXrIbrteoNZA2raUyWPcSOk0SvUT1exge64ESsTc934=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."....t@.D.6..ImL....pt...}q......o.?....{..k...?.'.?...;......._.~}.?......i...../.o.G.....?.?......X.?._......_h.........~..b...........K.X......'..._.t..{....o.<..o.....%>e.i.s..............W...^...=o?........?...........}....w...............G..._..'~.?..o...W.?..._.....~...........!..?....#......7....._.......c...... ..9..;.0..S.E6.e.)....z.C...LD.*.ms..b.V..{+....K.5.....kdV..Mq$..d...X....ET.];JA.(....T9...V?L.Wm..R..V.@...0E;O....xt..b.../|..L..!..vt...To.Ol..i.T%.L....D...4.+.i....}..^.t...7..5..C....8!..}......Z....>4..8F 4..!I./r...|.H}.rLp.....1.m...G..d...f..fM.$.s...JH;&.a,.......E....T$"..W.Q..IP(m...X.....U;.6.S.Ui.z..u.......dQ..t.cd...7...u..6?..d#..7{.o.@..... N.J..i.n.4.VR..,X...A.P.}..c..S$9...Q.$i...97..a..+%.K.....0iP[.4x.<;.@..r.8V.@..JN.{H.:....4v.b._..k...A}.'....Q..Ec.,t.b.z.*d.%.L..n.?.FOao..6M.S...U~.....'.xT..+....1fh..j..v....0.......f.l....V...s...Z..>.4....._.Pv.uQ...7.$...O6.Q..

                                                                                                                                                                                      Chrome Cache Entry: 292

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):90462
                                                                                                                                                                                      Entropy (8bit):7.976966393333891
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:05GnkNveINsxitIW2ld1S3b71IQb3xRvc45JlNE2nskaunTsX:05oasxitIdd4lbhZrJY2nPaKTe
                                                                                                                                                                                      MD5:9242E084DEEAAEEE9A7DFC679B51E9CD
                                                                                                                                                                                      SHA1:891D6A2F63AD389C0BE6B690F27FC8BEC7ED251D
                                                                                                                                                                                      SHA-256:F528C0546EFA7DC973F8878D23F8975984C2673D9ACD8FAF141A846623F8273B
                                                                                                                                                                                      SHA-512:477C7851CEE450ADE6FE833C9B3EBBCF427203B56A80A432B86EBEEDB0B62F743A7007C656303C9DAA7F28CEF533F7BC9B302EF32A183ADE7EE0C2847623EDC3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/npHAHmtZRgiMVEVg5pcncTIyqMW5MX--niR0L9PSzc5l8nuXS4GbU4w0yumQTururnc=s256-rw
                                                                                                                                                                                      Preview:RIFFVa..WEBPVP8X..............VP8L.a../..?.MHl.H.....;..?....".?.$.@.If.b.6I.i.:...X.. ..8.x.Qg ...u.|U.....fZ..W?.5.........2K..~}/.T.....v~.m..e).+.o]...Q.......O.xB.Z.-?.?.m..~.j....$.../...K.........[.$........|..j...[.!.<7.'..+.[.......]..K(...U.2...s(6..^.....p?o[...8.....u..G......I../.$.......I.".....5....s.w/.k ........hl.}aI..h....k.P.".dn0..V].I6-Py.[..$...P..T.n$I......bz...EP..i.........l..I..x.....F.<..9....&..:.4.H#B..t(@...5....Z9.t...$Q2(..._..6J.x.......G....nT....:uB..i...a..!..N...}`7.s....h(;'.....T4..6.6X..!...(.FS.;.s{..3..;.....*.s..q..WC.~.{u;<._./...B..~...%.......l.q...~._...Q....i.|.P.....`...H.t..c!.a/.G.G<)....4.3.N..j&u.&........6.{.......N....z..u&.Ssrj'.4.7.....b.Zp...`aa.....~.....Y7..b.G;.c...+Oy.......h........Y.I[.OTJ..P.Q.....,...c..F_.....x.L..>..k.y(U.q...=...-..r....:..5...T....I...8.l.M.O...<.rQ.q. ...;&]....N...1....}i.....)@Qc`..d.9.........,....w..N.....y)....9p...G..j.p.>...qy.d.U..`=s!nO.....p

                                                                                                                                                                                      Chrome Cache Entry: 293

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37288
                                                                                                                                                                                      Entropy (8bit):7.994762848094783
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:UQSzY+QT8ixHcLcMPO0iDX5nGViyewu06tKiCMSrCgTFEbg:UQSzJQCLcMPO9X5nGViyej0dph
                                                                                                                                                                                      MD5:156C2C8098F1F956D43EF04E6FC6DFF4
                                                                                                                                                                                      SHA1:5844EF40E7C70C89F8B30E94E3EF7DE57F37BBD8
                                                                                                                                                                                      SHA-256:5A79395E0FA29B172E332D0600B70A3B90D36C425421C16F514D087B50829571
                                                                                                                                                                                      SHA-512:E0722ECA4C570C68D21739F407FC18E5FC3695DA344516EDBAF226FC250F1B989B6B34C2A132D6EB95CC1FD8F04D757E277DC104931C98C988ABA495FA00DA49
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."....t@.D.6..ImL....pt...}q......o.?....{..k...?.'.?...;......._.~}.?......i...../.o.G.....?.?......X.?._......_h.........~..b...........K.X......'..._.t..{....o.<..o.....%>e.i.s..............W...^...=o?........?...........}....w...............G..._..'~.?..o...W.?..._.....~...........!..?....#......7....._.......c...... ..9..;.0..S.E6.e.)....z.C...LD.*.ms..b.V..{+....K.5.....kdV..Mq$..d...X....ET.];JA.(....T9...V?L.Wm..R..V.@...0E;O....xt..b.../|..L..!..vt...To.Ol..i.T%.L....D...4.+.i....}..^.t...7..5..C....8!..}......Z....>4..8F 4..!I./r...|.H}.rLp.....1.m...G..d...f..fM.$.s...JH;&.a,.......E....T$"..W.Q..IP(m...X.....U;.6.S.Ui.z..u.......dQ..t.cd...7...u..6?..d#..7{.o.@..... N.J..i.n.4.VR..,X...A.P.}..c..S$9...Q.$i...97..a..+%.K.....0iP[.4x.<;.@..r.8V.@..JN.{H.:....4v.b._..k...A}.'....Q..Ec.,t.b.z.*d.%.L..n.?.FOao..6M.S...U~.....'.xT..+....1fh..j..v....0.......f.l....V...s...Z..>.4....._.Pv.uQ...7.$...O6.Q..

                                                                                                                                                                                      Chrome Cache Entry: 294

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65284)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):140929
                                                                                                                                                                                      Entropy (8bit):5.21374304277125
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:MOgAc1fFOszeCOG3RxCK8Yi/Glq+dBZDUiOMRLMGpukRRgj8evHgZsUgeAq5qV8h:uQCL7ji/udoxKRRtYHgZsUgeAq5qOsJu
                                                                                                                                                                                      MD5:10AD6473484630A85272174DE546FA21
                                                                                                                                                                                      SHA1:EA40634DC07BE2074345CDC14F6844D3CF3F02BD
                                                                                                                                                                                      SHA-256:36231D9CCBF4581029B3733C99C07B587CE56A7113B74AE7C0C0A083AEC38029
                                                                                                                                                                                      SHA-512:547B0D695D42E176E02927363B4AD90E69143A130A3E0FEB222F1A6D7F6A4DA543CD5267AC31871672E70A7B8F999DDC362D674099BE7F326D05B654F72442C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/**. * Swiper 5.4.5. * Most modern mobile touch slider and framework with hardware accelerated transitions. * http://swiperjs.com. *. * Copyright 2014-2020 Vladimir Kharlampidi. *. * Released under the MIT License. *. * Released on: June 16, 2020. */..!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).Swiper=t()}(this,(function(){"use strict";function e(e){return null!==e&&"object"==typeof e&&"constructor"in e&&e.constructor===Object}function t(i,s){void 0===i&&(i={}),void 0===s&&(s={}),Object.keys(s).forEach((function(a){void 0===i[a]?i[a]=s[a]:e(s[a])&&e(i[a])&&Object.keys(s[a]).length>0&&t(i[a],s[a])}))}var i="undefined"!=typeof document?document:{},s={body:{},addEventListener:function(){},removeEventListener:function(){},activeElement:{blur:function(){},nodeName:""},querySelector:function(){return null},querySelectorAll:function(){return[]},getElementById:function(){return null},createEv

                                                                                                                                                                                      Chrome Cache Entry: 295

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2279
                                                                                                                                                                                      Entropy (8bit):7.8586454360102564
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:tYdz7SIhffiZAdEEOUHqoIDCB/hailDB7yOqtJ:Sdz7SIoYHONmB0G2J
                                                                                                                                                                                      MD5:767DF8EF75C1C7BF716016B70583E413
                                                                                                                                                                                      SHA1:F9601C0B124D352E01B6DD676CF4C974022ADE44
                                                                                                                                                                                      SHA-256:9C0142625701BC4983F37920457FB76DF0CFBB338CD818872B47B468450CA179
                                                                                                                                                                                      SHA-512:7A4AAB3E41FF26F37F085BC0D70C9B1518E92344A5F786630C7DE75DCDEDCD6BECCFF228634648EB81F1F162F229C8784B56B8AD53F540EFB664AD2140DABEF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD..............IDATx...O[...?.slc......IC..o.].vM.5..:-.U.%.I.6i.E/.wL..v7....F}.....v.H.iD.!.%$!.1...s...6.&.............}... ..B.!..B.!..B.!..B.!..B.!..B.!..4.:E...Vl....B)..B@~=.e.(.{.......7.~.%.p5...Bi.k.\....!.z...v.}....W..T.P.....?...X....d...l&....*.r...f2.LP...D.^...m.S.P"n...Q#.Y..pwr..Bi......T.i....bq.|........P.....>gd...}A.lE....P.4L.T...5.u.4...i._q .a..h.m....$....Q...X.D.m{.D..j.....X...Kl[G]R..H.T@>r .H......R..@5.0)H...e..c....B.@jaja..^........"....D9P...4^..MDr ..........-.....B!:.[0..W..."..cI.....L_..bP]?t"...{..K..#......u{.8.k../.T^...N....yMp.g....aq...O.......x..]Of...`..L...?cs...).....;..cx6.....g....`._c....@@............).p....2|...C.eh.._...6.s..>....[{.kE.#..7w@...5...L.Caq..k.....&`.>...2P.;...+x{_.s.....Z.A,.~.......u....._...%...n.W..R...O..l...I..7.Z~...A3...C...vH.q..9.c.B...^q.S,@K'...9........0}......k.&....a.s..!$3p...w.&..........d).a.6$R......n..-....9..0}..s..

                                                                                                                                                                                      Chrome Cache Entry: 296

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):200
                                                                                                                                                                                      Entropy (8bit):6.878063612294382
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:wAi1Z6iB1toFkCoH+GN2jQPRwS9gJY5derhz6:wd1Eqt8qNN2jaRxgJY5Ec
                                                                                                                                                                                      MD5:26AE874F3B7051BC5B112960C251080F
                                                                                                                                                                                      SHA1:1D6B38F7FE58DC79CC66CC0A3EE42CAAA096B686
                                                                                                                                                                                      SHA-256:8C66B3CB207515328AC21BDBBDA1B90A74D7CAC66267352048BFD7E4E1EFE627
                                                                                                                                                                                      SHA-512:88DBFE63B9A7374528308BD4AC891535C310FFC2277C3A44004772ACCEA7115D8A1DF77ECB56EDF573000DF4AFC79E7E9524B4FB8C8E8DBAC2384860306F0C31
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../....58l.F....._..2.. .p[[..L.nx.......!V.....R..A...........x....>b.z[..j{....%~.{..~+N.sUy.G.....D...x.poN...,`....>....o...Z.*....u...,}...^..W...v..Z.u..^.`dg`j.|...q....

                                                                                                                                                                                      Chrome Cache Entry: 297

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 1520 x 885, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):54845
                                                                                                                                                                                      Entropy (8bit):7.800274888616153
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:a9ZyHzX61i7rB78G+sSwGb59dndhppBKlBpeGGkoMp:VzX647rB1VSwGb5/ndhpmBI/Ip
                                                                                                                                                                                      MD5:A19170026864DFE39B7A2A2A545E3E1F
                                                                                                                                                                                      SHA1:E08C5B973ADEF3FB9EE826F7B6B8735D3353BCA9
                                                                                                                                                                                      SHA-256:DFEEA1EADF4EA7811D7EB096A386E18167AE4201AD499205A31037738033AC4D
                                                                                                                                                                                      SHA-512:21ADFEBB61471D92AECE00406E43E467727E61D2BE40D090E7F65D1787C9266FF8565B5CA829C0B446CB67C9B49C84CC7C7C9EB07B7360725340A898A108072E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR.......u.....0..&....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^...$gA'l...8...................V7...........C..C.A ....@..B.`...d..'.$3..L&..9..OwUuu..tW...L.=.}]......S..uM.w......`.(......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.).a9m..^....z...x......;.~8.n.aw8...|......<....<R.w"Il.\>..}.......>.....L...@..g..k?....;RL3.].[.=....Ib;L.....{.P1............?[...'_.'l...Z.......[......^.e].YB._.....W.......D.?...y...n..".......E.9~......n.S.g.S.s<.....W."..'._.....X<....~...W.,&MY..~b.gP.....?...[...\.+.....,.[...G..bPB..p..b...+|...".ymx..j.).........b..3....a{1u...`b._:.nX3:]....H.._.'.tF.<o./.J.S..3........M..(._ry/...9..}.Z.....kO..u..17..7.w .8\.?.Ca.C.....|.>..].z...`/.......{E.ux.o]..?..7.jM..>..,......s_.......A......n.....3..e......

                                                                                                                                                                                      Chrome Cache Entry: 298

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2810
                                                                                                                                                                                      Entropy (8bit):7.887433756129589
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:bvu4BqXz5NW8pECq2nStghcANV7y6wmkcyvcrZQ6ekuL6QCEZVWfLJzVIM+Y2jAg:bw68TSyhce3wda3ICEZYLJx6Y2jAZ5G
                                                                                                                                                                                      MD5:24FA213EDB52E2405873BD5979E2E87C
                                                                                                                                                                                      SHA1:79CC0BFEFFBD6B23D55A6450A31739E29B2F0F0A
                                                                                                                                                                                      SHA-256:BBF7218DD9F40B1CC7D09D487F6DB6681DE42E4A230BD10D2B19F6AA14FC20E7
                                                                                                                                                                                      SHA-512:F82E07AAA75AB9EB95206D3EEC6C4612A720DF5253D276061625502804D7F04D439945E8D217A87601908583EDABECF4DC3338DECC20C0FACBA7F9D986695693
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............ALPH......t.i...m;).m.._a....m'%'E.v.,..{.`.v#b.........e.........a.`4b...bb.3. ..n........_$..7.^gP..?.' f..".R..:..0..../U.6..c.0..4e\.{.......d ..:h.d..c.....4`.B..0...TR ..-E..%...P.`!$.3...S.O.?....S.OAm.b..a.:......:........W....-.31...F....nc.L.0.........]..;~.....i.....i.L...wl)8.Y L.`......>.1....<...o..0a.../...I..x..\..[C$fNM.q9.....4 ....x.W..3... .\G3LPp..+r.....\.Fs(.]v.{L......K...@.s.\k.........H.Dj.7...._.F7%......Z.?..L...,.t..Bo.ev....}..n#......~k..4.F.a|=.:..n<.2........S..h.N.....qw....Fs4.]n..LL..<.8.}y ...-..Z....S.<n.&.]..X...3..U.l..|....3./_.w~X....Y.4.....5O^v.....i....Xe..+..^..*).$.Yp..Wb^.+&..5..F.%.H..T...I..BH0.. ...$.....((...!..."`.....r." .1...........b....$.....R..# .A ..j..t@hOY...VP8 .....4...*....>)..C!..%W...BX.T.i...X...w.....8.....#....O.n......?V?e=.?.=.~....B.Q...S.....k...g....._.....o.Z.ts.....nY.`w..3A.So.1.{..<.la...n...".U<.....K..7=.'..c.N....q..F....koc.}&....(..Xr.'

                                                                                                                                                                                      Chrome Cache Entry: 299

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1677
                                                                                                                                                                                      Entropy (8bit):7.1663617929645085
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:rMYLNn2Mv0jJ3psiGSkYsOYQ2qd+UWfsc:gYR2MsAX9k2qded
                                                                                                                                                                                      MD5:C0AE4497D95E0AC5D000378425DA1161
                                                                                                                                                                                      SHA1:5AC3393939386D7B78E4D7CCFAA95EF011931F5C
                                                                                                                                                                                      SHA-256:FF9CDCF1328D8825C8D6945C60333A665A1BC10087E8470DF3F29C6589E8FB2C
                                                                                                                                                                                      SHA-512:7F27A45B995E1B41A2DCE45E3DA399A6F18A13E5310407C0EE3AD05C7D99C5F017CC8543B3580CD0351A55CDB73A7E913F84AB49310B0524308F3DE66C6E874B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/download-more-icon2.png
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:42CAA64EA22411EABE3FA987F0B8798B" xmpMM:DocumentID="xmp.did:42CAA64FA22411EABE3FA987F0B8798B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3C280709A22411EABE3FA987F0B8798B" stRef:documentID="xmp.did:3C28070AA22411EABE3FA987F0B8798B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>).. ....IDATx..Mh.A...?..""E=.......ZP....S.z..$.k....\J.jk.E....^..I.6.."....X..;2-q..Lf7;Y...l'..3..7...N'.

                                                                                                                                                                                      Chrome Cache Entry: 300

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1180
                                                                                                                                                                                      Entropy (8bit):6.526235225312809
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:F1hmYaWwjx82lY2T3QvV2DwbyJ3Vj1GMUyeWIPehC0:rMYLNn2Mvp2J3D//zIPehC0
                                                                                                                                                                                      MD5:B78A81594CF27BD6A7502BE72A9936B2
                                                                                                                                                                                      SHA1:5728D813A3BEB53686119DFC57A326F23D231FAE
                                                                                                                                                                                      SHA-256:70C8F4D1883346B5484129FE4D03042C71FC1228D91B64870EED3D2CD5EA1E48
                                                                                                                                                                                      SHA-512:BD3DE8165E8084A550F422C888250A385801202C3F0D5B2E4962A4BF358656ED14C74F33FCA02F77206DDB674E3B91F082EC090E513C586A595E35B0BF6C6F21
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:3C280703A22411EABE3FA987F0B8798B" xmpMM:DocumentID="xmp.did:3C280704A22411EABE3FA987F0B8798B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3C280701A22411EABE3FA987F0B8798B" stRef:documentID="xmp.did:3C280702A22411EABE3FA987F0B8798B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.=......IDATx..=..@..3......[...D.%k.BD....<...Y..u`...l.#..!o..f..m.g!!.}.9j.......P.7.(r.uy.`.X.?{<.......vM.

                                                                                                                                                                                      Chrome Cache Entry: 301

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):16386
                                                                                                                                                                                      Entropy (8bit):7.982989558568567
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:JjNHgFUIQBL3AuODO64jjPUbWIjY5IZK3NDBk5z7xlvlUhY29XxEVdnlx4jm97B6:TayLQPO64kyIjxwexlt2Pi863zTi
                                                                                                                                                                                      MD5:4D8AB3ACE7A18CDCC2F2948C46656887
                                                                                                                                                                                      SHA1:2F7A1B9DC339182963254090126DBF1C33B524B5
                                                                                                                                                                                      SHA-256:33BD5D724DCC536558F07DA7B422497C193DAA2C16C6380C0D567B828242DF10
                                                                                                                                                                                      SHA-512:77BA8B2F3BD9A1B2036136F43E197473F69A0D706752ACB66875E71E33A3DC4D2EFA9469C86DC014220E1FD4BE0B0A81104E7CC1E5324765B3C2979778BBF3C2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.?..WEBPVP8X...........'..VP8L.?../..I.5..m.i..S..3"&..:;...m .-Q.......F.z6.09..:.s.;.=9..;yr.9'O.9t.<.=9.s..?....=...Ox1.u..N.t.a.w.......A.K.C..A..>Vg..]h...@\1..i....s..P`hV./..[.m..b..t........j[x.b..-.....tQ..k.u...u.0..uZR...l........C...g.FKcX....5'.Y.a.N.l...Z..c..:..a. .L.........A..$[...}..._.2...6..%D.,.J.?.a...zp./........u+7.e...<..3..L2........1[..........5g<..xV.2.8.*33.9eV.......Lwq......0tU.0.w.+C8..2w .e......-.*.f.9.X.-s.2.K....en.......m..I....Km..Scl..m.m.8)$........w...H...Q....{l.6.k{...e_..\.`5R..(.J....3....L...o{*=...:......P.*...R.f..aEia!.mMfc. 9.^.h6.F>.9bT...?..{p/.-....Q......_....^.....|q..g1q.d./.3.&..(l&ok..8../.....s.......|\..........6.)Mzc;...@..o......b....H.~.b.......*k3...c....4.9/T.n&EnY../......U.n.&ULa?.........o.....NlY.%..)W\c]....../-o..i.@..}`.5...z...l......../. .g..l).u..$......O...3.X3.........R..V.n.izj.._.G.0..O..v./}CU..B.v.....&..o.....`..+I.eh+9..EnN]8:...W.k..Xw...5....|.l..

                                                                                                                                                                                      Chrome Cache Entry: 302

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2626
                                                                                                                                                                                      Entropy (8bit):7.893439963066842
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:RPHt0br566TChfJu+OXLDv3RfJPOIxdDtm0AIY4gqcH//:R/O5BCRyblfFOIxPm0AIYUuX
                                                                                                                                                                                      MD5:95435F45957212672D08174848909326
                                                                                                                                                                                      SHA1:EF8BD194997C37B76DB2A4BE25E8650DAA3C337E
                                                                                                                                                                                      SHA-256:65CF337B9C3C4B38BF55FB3739A197ED79676B2910009BF7B23A5EBBF21B853C
                                                                                                                                                                                      SHA-512:63AF98DE4C82823ABBB9EBE7A8964DB70918952791F2D658C92832D4339CC88C2572483656B4D87EA2CB6A30A0AE3DEC6D99E1A9C843C373D4A0A36E9E7AD6AE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF:...WEBPVP8X..............ALPHt.....sm..mm.Sm.Ff+...l.vMk..km.m..+.....}?.....0..$..%]_...I*)E..(A..$...D?HJH..e.......w~.W....K....&{...;.....G(.XJ.s.6.n...JIG...M../}...S!.=...c_..R.a`.;.......".}.......)..}.lp...\.h.....7T......./7kQ.....V5..nNl..t.Fl8'6..jJ....MS....R..t^H..4.y.FS.13.....#.d....W._......W._.....l4#.......w..._.<#~..:.k'...,K.J?r.b6.}t.T.h4.......h..z..g...U.4M.'..,..{.4ES.g.{{f@..{wD.(.y.{On>y..i.=.@.VQ.}..3........K.1.....>.3.;p..&.?...[.?p.=!.bX...}.;.{.?..n......."D....b..!M.A..ii4.LJ....IP..ZZji.D.X... ..R.#..ND.6#!Bt0,Z..c..."A,m(.Ti:.dt..H#..i(.....H.......4.4..tf....P..B.T3..F..Zo...I..A...kF.VP8 .....0...*....>)..C!.!..]......p...H..r.R.P.<..........3..t......^......?..d.s...K.....C...{...OU{..dk..3......\.....48..Z0..^t.....c.c.g_.A..R&.-..3a...........T^..).|..........9..~..XT..\.[";\?.n.T..o...W...."u..^^y.e..3Xp*p.d..$#..N$.J....2O/.jl@..u..........N.'..|.a..WN.[...6..IX...H|:...).k.m............'F..

                                                                                                                                                                                      Chrome Cache Entry: 303

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):39328
                                                                                                                                                                                      Entropy (8bit):7.994553634657984
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:A/WR0bD0TlgaAMvBzBy8EWlua4yrg0yPlnGMMZmXVTI8Wgc1W6:us0bohfzOWlu25qliZmFpzuR
                                                                                                                                                                                      MD5:D99582F67A3ECE0D09B9D9D540FE885A
                                                                                                                                                                                      SHA1:87DD927AD44F8A9EB59BBC13DBE8F89F5E7A2AEC
                                                                                                                                                                                      SHA-256:ABABC2F9BC320FF88E90359EBE4FADDBC51A98C35E2C5783CCF0D5872F3E0C88
                                                                                                                                                                                      SHA-512:0BE4FDC1E427AA9072290A21C19B8D0C0619DC80999FDF9C5DB5AF6B67235D38B87F8CBE817877C6AFCF7FA0774A76451D2D5F7AF7FA1A96344742FE60EEA871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/-30kBgxxVCr2wH1pR6K9z__L94lJSylmwo5AxPLEAwe_iUMe2vzb2sCp0jmQDRmbow=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ....0....*..(.>i(.E."!.[..@...6........F3=Y.t..~....O ...O....k..v.../...}......+....p.._...r=.~.z......{.....g.G.w.........{3~.....zu..|5.t.....u...........x.......S............3}....W.....'...#.....|..M..._......o}....N..W.w..j...O........./.....v.`?.?..............u.........?..o~..........._........y......l.....~....w.y......F...7^.e[..@Mhl....o...Kx.ez....D.^...Kx.'y~...=s(nr.<..{.3g.)..3.e.j.u..?h".P5J%G....v:...)`..xD.#!.H..cv.Z.Q....Y9.mF....h.-....rSX..j3...-m^..n....[......R.z.........u~....nB....!(I.S.V.x.:..=:.(..h...`.\...jE79..-$.~R.a..]m.....k./..M.....[z..4(...cvu.. .CEU.$..w*.f...f.Y.l'r.r/S.Yh..G-,.Ew~.u.*.C...]ynF.?...8.l+X2}^{p...G..2.R...........:xrHW.zU...@{.b..w...?].........-..'.....?.W.S.t..z.e....h..L.0.^....uq.Q.p z...8r.I...v3......9..K"hC?.../q....~....!Q.../..q..............5.Z....V$=...u...J`[8..;h.....l.;..W.b.{.W).W1..E.D....../...1i..}....C.).9....[y.`.....Dno..D..qC9.....E...p.*d......Z*!.p(T.

                                                                                                                                                                                      Chrome Cache Entry: 304

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), CFF, length 233240, version 1.0
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):233240
                                                                                                                                                                                      Entropy (8bit):7.998929579369334
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:RFtUp8TP0YyjsuhShhu0bAlZYs/UAkHgX4gf1G:RXUBNshhu0bA7YscgX4gfU
                                                                                                                                                                                      MD5:86A24C421A052D323E49A952D88805B5
                                                                                                                                                                                      SHA1:814A9DAF46A34AD6BC4F5BC0DE4940B166A85870
                                                                                                                                                                                      SHA-256:A359121948E08165E21894786EE4E4E3C3F1AA55BB44DBAAD470D4ADF1B7DB9B
                                                                                                                                                                                      SHA-512:0993B3670D42D9032831122D0E43D1843DA2361D8781B0CD75AA080A57F9DA273AC8A54414F8598EE12B2878787245B564A07F7E401C0282A47B5A0F57A825B3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://fonts.gstatic.com/s/googlematerialicons/v142/Gw6kwdfw6UnXLJCcmafZyFRXb3BL9rvi0QZG3Q.woff2
                                                                                                                                                                                      Preview:wOF2OTTO..............................................X.`..`.6.$..d....~. [......<.....* .d..K..A...&@..\....n..!.N...(.G.../.v.y.....................n..n...l*%.H.U..r.xp..Q....z.A..G.Q*...4R.@NZ7...5..^.RE.MjY.l.....v.{#.T.J.*..J....*....2.h"&.l.+Se.UI..J*(A......9j.4.j.hjaq.|i.1`.p,..S.W..,..:F.k..w.H.t............ ...(........t{5...r.5#"....].>*..Z.}...l5"".XDH.*5T..M....;9sw.c.!....Q.}.........8d1....QH.*.....I .%72..s.......fQ.V;.SH...V.W...q..2-...Y#+.6..m..D@..?.g!5TSZ...R....D 7=...v.K6..p.." ...v..j....F4...?.....<.s..Z...._rw.......4.B..... u&4.'4l........@~..E@X..,y..].$..]f-..$i.o...\9..2.`.6.#...W.j...7".o..V....%3..........!..?U.J.V...V..Mvz.....>...A........Z.D..3..s...!W].TUR.nUed.B.[.IK7.`.5...*..DJ.<.ME.\X.h.wJ..\0s....z+.EAF..4..hr....;...zE......9..d.Z.I["2...2c.'..:.v..3%C..2.S.9.s..h.m..Qk..J.....'c...Y.G.........&m..........v.R..].z~..4.ZC.s.......0]`[......./..O.)Ri..f.H...d.I....<#|...C.../.Y.~e.vN.u....Sl.|

                                                                                                                                                                                      Chrome Cache Entry: 305

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):7510
                                                                                                                                                                                      Entropy (8bit):7.953539678433074
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:7rPcwFQ+XWwNzt021tuM572WjKH6GLkF91hhYPVrCIYIAG7u9vtTTpc:n5u+Xhzt021tLl2DdIF91fsCPIaxtfi
                                                                                                                                                                                      MD5:7B14CC70044D22ED1DBE4CEA4CF7E556
                                                                                                                                                                                      SHA1:6AE8ECEDCF330CEF36A966F940D4B428642FDD07
                                                                                                                                                                                      SHA-256:4FB627F8370C1DD127E22986AB3779DE7FADB0CDA4D8A1DC69C4801896D8E638
                                                                                                                                                                                      SHA-512:50CDD75BECA37860D909752A7511D0309468B492DC0AEE741E434243DD8083640ACE37934B0AE6627F1544C1D7207E29C06D5C25EFB376995412C203F6D8BBE4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/ok0Vj1zvs1kqK86Go_9SG-10mwSL_8eql_QPxWrwVrXY7cts9leX4DHOHFJ-5G4t87Vu=s64-rw
                                                                                                                                                                                      Preview:RIFFN...WEBPVP8X........?..?..VP8L..../?...M(l..Vv.Z....G....|.5O.n.Q..`..#....h...$Ee.>....m.8.H..dBbB.."bw..?..$E.A.Q2....?.........x.A..pF......A...7>.G..Nl.*.xn|qd..H.}.k...{....O...._.#E@..../.......1..m#..ao.@.....p".$..(...V.\{.+......I..(.....A."^...k.5...m....u.%.E....M..rFe~..om.m..Si.A........QZ.G.....3.....cf.9A..I...m.(..>_.m.m...~.m.XT.t..4...<^.#N=...m[....I&.k.fff...a.y...X...B.....0Q..$7....U.m..mk[.6...4.....m..p.....un.mky..1fWk..P...S........f........R..{ZqT^.1....C..]KY..yc.....$.".CR......S+.k....#..(/H.k?....Z.....@..|%T.IpS-.kg]).`..u..............m...%....t.+....g-9...d..4.-.......v..Nw,..o.`...O&.qH}.....U...UW.W;.h...."Y../.MD!A(...`..G{..z......^.E...8.+/].!4.u.!.s......i....Vy.o..cYKwQ.fQ(.S..b.8SH..S`D..d.+..k.....'...i..J........W....xN..C).L...........d..[B..!.!....aGV.m.=..?..Y......P......k.....xH.+...-..JXN...z.../....p.P....K..n.0..j....,{....c.+:.E..H...T.....e....i.............=.!P..b..X4.P..F.../

                                                                                                                                                                                      Chrome Cache Entry: 306

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3089)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69640
                                                                                                                                                                                      Entropy (8bit):5.428026405432715
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:8Rx5xxd9L0ngo2qQmDVeClRhw7d5i8q7nXxaFuYPdZIJVNfOT/BhqxlWZ:8j1dF6goxVe8vwiUFrdC2T/TwkZ
                                                                                                                                                                                      MD5:F713EEB3B0A890A92D79B1B20AB97B0B
                                                                                                                                                                                      SHA1:0262AD1062E4FC48562B58619FF2259F337D118F
                                                                                                                                                                                      SHA-256:34747B2688FD1736007211CCCA2276A7C23F05228D1C4B5C2D4D239DDDBDFD14
                                                                                                                                                                                      SHA-512:2B99EA22E50A6AF7988C5670411795A093A8CA25352BD881CC44FF141985C521FDFEA104F64F57B9A5C5572404516780D31CFC0D411B61DB1566020AA924068F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:(function(){'use strict';var n;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var p=ca(this);function t(a,b){if(b)a:{var c=p;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(h){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(h||"")+"_"+e++,h)}function c(h,f){this.g=h;ba(this,"description",{configurable:!0,writable:!0,value:f

                                                                                                                                                                                      Chrome Cache Entry: 307

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):37288
                                                                                                                                                                                      Entropy (8bit):7.994762848094783
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:UQSzY+QT8ixHcLcMPO0iDX5nGViyewu06tKiCMSrCgTFEbg:UQSzJQCLcMPO9X5nGViyej0dph
                                                                                                                                                                                      MD5:156C2C8098F1F956D43EF04E6FC6DFF4
                                                                                                                                                                                      SHA1:5844EF40E7C70C89F8B30E94E3EF7DE57F37BBD8
                                                                                                                                                                                      SHA-256:5A79395E0FA29B172E332D0600B70A3B90D36C425421C16F514D087B50829571
                                                                                                                                                                                      SHA-512:E0722ECA4C570C68D21739F407FC18E5FC3695DA344516EDBAF226FC250F1B989B6B34C2A132D6EB95CC1FD8F04D757E277DC104931C98C988ABA495FA00DA49
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/Btu4e_lYz630tIhMeDrwQtxH9WzYJ--Egmp214_ANwvgs0NMIOTEXmfk1S7WSkG9-HE=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."....t@.D.6..ImL....pt...}q......o.?....{..k...?.'.?...;......._.~}.?......i...../.o.G.....?.?......X.?._......_h.........~..b...........K.X......'..._.t..{....o.<..o.....%>e.i.s..............W...^...=o?........?...........}....w...............G..._..'~.?..o...W.?..._.....~...........!..?....#......7....._.......c...... ..9..;.0..S.E6.e.)....z.C...LD.*.ms..b.V..{+....K.5.....kdV..Mq$..d...X....ET.];JA.(....T9...V?L.Wm..R..V.@...0E;O....xt..b.../|..L..!..vt...To.Ol..i.T%.L....D...4.+.i....}..^.t...7..5..C....8!..}......Z....>4..8F 4..!I./r...|.H}.rLp.....1.m...G..d...f..fM.$.s...JH;&.a,.......E....T$"..W.Q..IP(m...X.....U;.6.S.Ui.z..u.......dQ..t.cd...7...u..6?..d#..7{.o.@..... N.J..i.n.4.VR..,X...A.P.}..c..S$9...Q.$i...97..a..+%.K.....0iP[.4x.<;.@..r.8V.@..JN.{H.:....4v.b._..k...A}.'....Q..Ec.,t.b.z.*d.%.L..n.?.FOao..6M.S...U~.....'.xT..+....1fh..j..v....0.......f.l....V...s...Z..>.4....._.Pv.uQ...7.$...O6.Q..

                                                                                                                                                                                      Chrome Cache Entry: 308

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1266)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1300
                                                                                                                                                                                      Entropy (8bit):5.30524883704663
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:hYycgSHiSlajeJvJDyzGpxH019FEYvNvZVusgDUmEZ1r2ilHhiomA3ef3EQJZomW:hYyZSHvciyQHEmENRVcUzb7H6om3JXof
                                                                                                                                                                                      MD5:4412BF8023109EE9EB1F1F226D391329
                                                                                                                                                                                      SHA1:C273960AA874A87DD022B5E597887142F1B8E34F
                                                                                                                                                                                      SHA-256:D40EFCAC911D8964F3728EAA767DE281306FF55BA9377435A3364D4D1E1613F6
                                                                                                                                                                                      SHA-512:DE3DD553A582E6B3D00782DDD639CB57B29DE71AFE72AF5ABEF870AB36C7FED68244D511A1E129A0F04AF690F27AE9304B1C113C9F1F0E0BD85DDE9291A6764C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/*! jquery.cookie v1.4.1 | MIT */.!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?a(require("jquery")):a(jQuery)}(function(a){function b(a){return h.raw?a:encodeURIComponent(a)}function c(a){return h.raw?a:decodeURIComponent(a)}function d(a){return b(h.json?JSON.stringify(a):String(a))}function e(a){0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{return a=decodeURIComponent(a.replace(g," ")),h.json?JSON.parse(a):a}catch(b){}}function f(b,c){var d=h.raw?b:e(b);return a.isFunction(c)?c(d):d}var g=/\+/g,h=a.cookie=function(e,g,i){if(void 0!==g&&!a.isFunction(g)){if(i=a.extend({},h.defaults,i),"number"==typeof i.expires){var j=i.expires,k=i.expires=new Date;k.setTime(+k+864e5*j)}return document.cookie=[b(e),"=",d(g),i.expires?"; expires="+i.expires.toUTCString():"",i.path?"; path="+i.path:"",i.domain?"; domain="+i.domain:"",i.secure?"; secure":""].join("")}for(var l=e?void 0:{},m=document.cookie?document.c

                                                                                                                                                                                      Chrome Cache Entry: 309

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2454
                                                                                                                                                                                      Entropy (8bit):7.656647028291637
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:D1ZaB1Kuq2uqM1pCRK/risvPtk0iKdrOItz4rhAp0IH3gS4GAAZqe7QONmOLm:3I1vq6MrPr1v+krOYWhAp0IXXRAze7Bm
                                                                                                                                                                                      MD5:9CC4BEFA5AAEA2BD8B762553C4ADB462
                                                                                                                                                                                      SHA1:54749D2135966E01F9882A9C58E72C3EE92951B5
                                                                                                                                                                                      SHA-256:970A6A20C4FA6923E48EE64EACAE820369729FC96787B83CCB81BFD892C32DD4
                                                                                                                                                                                      SHA-512:AA4462B404F0276BFADA7861805E112535C3B4F29DA3E6A7B0BD3F37C3B5303DA7A0F1EF81502D5B3DC0D3E2A932692F763BDBB73B7F9D4D347EF683EC7A3B11
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD.............KIDATx...{l.g....t.;.8c..b2.^.?...PzgCP'....f.m.].......#3s..N.1.1t.....h)....o]......{K.....yO..C.9.<.9.y...s+o.....yO.u.P(...B.P(...B.P(...B.P.\......,.,...[JJ..KJ*.:#U............V.......C2#....{.....g..e_.F...W...\.2.......O..@.9 1...Z]...<.v<F._.=UV}..m.M.>....y.....z.....9.....J.....t...C..b4.....v..o..#G.7...5..N? ..........U.+..}O...^...P.........X3y.Q.e;.......'.<.%..7..{ z.z.@...).P.:.;....<.^...l....pbN.f.e.d=.....t..e.hi....T....R J...!%.........H...P. .l..@..2............H. .....H+ .!..-...@..m.* . .P..m...............2......\H.d+ . ...@-..8...i..Q1...i.T...pH.....i.d.tH...PrH...T..$......y..........H; .!..m.t@........v.@d.$.......Z..Rm.@. M...>$?.......&@.B. .......t.r.......2......\H.d+ . ...@.q7s\.... -.<.q.$.........@.C. ;.......jJ...H...P.# ..v@: .....i..@R@fB...............y..H.F......Cz..D.T..$`.q..~..qZ..H. .).s*-H/wwP..$...mA..Ho..NOg<.^..K.hw ...ho.<f:...t....Rpt.D..

                                                                                                                                                                                      Chrome Cache Entry: 310

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (17998)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):18618
                                                                                                                                                                                      Entropy (8bit):5.640300193320173
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:MolxP/aWS4dj4lfFVqEBSmur4+O5Un8OxuTtLRsFOuohfa8wnaeDg3z6MVRegEW9:DlMWSKcKDOhtLCONa8qae0rVReZWrPJ
                                                                                                                                                                                      MD5:59D00FA56FB8B29068D96A431A52AE7B
                                                                                                                                                                                      SHA1:9F8C5455383C49873A60CAEBACB1DECAAE0F909E
                                                                                                                                                                                      SHA-256:76E6DCC56BA185BAB0F2E68B485146BC42E79395A67DF0F7C23A18790677DE09
                                                                                                                                                                                      SHA-512:3BFF8DCB6FDF2B4DE78211D636AE0310891FE6653CD1C6CADE0AE8039AC0EB67659DA142040B6290133E0D928FA1D22061F0A043D86F232AD40527A80B30F7EE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var c=this||self,C=function(d){return d},m=function(d,a){if(!(a=(d=null,c).trustedTypes,a)||!a.createPolicy)return d;try{d=a.createPolicy("bg",{createHTML:C,createScript:C,createScriptURL:C})}catch(f){c.console&&c.console.error(f.message)}return d};(0,eval)(function(d,a){return(a=m())&&d.eval(a.createScript("1"))===1?function(f){return a.createScript(f)}:function(f){return""+f}}(c)(Array(Math.random()*7824|0).join("\n")+['(function(){/*',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'*/',.'var dB=function(d,a,C){if(d.length==3){for(C=0;C<3;C++)a[C]+=d[C];for(C=(d=[13,8,13,12,16,5,3,10,15],0);C<9;C++)a[3](a,C%3,d[C])}},a2=function(d,a,C){return d.PE(function(m){C=m},false,a),C},cb=function(d,a,C,m,c,Z,e,F){return(F=X[(Z=(a=[27,-7,-92,-77,46,39,a,14,55,37],d&(e=f$,7)),m).V](m.uZ),F[m.V]=function(f){Z+=6+7*d,c=f,Z&=7},F).concat=function(f){return((c=(f=(f=C%16+1,+a

                                                                                                                                                                                      Chrome Cache Entry: 311

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1272)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):31193
                                                                                                                                                                                      Entropy (8bit):5.079001832957625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:t7ei8OWdOR2rdmfW8lajmqRBBm+K+VivTJoNjrkk:gi8OWdxh4W8lajmqRBBm+K+QvTJohAk
                                                                                                                                                                                      MD5:57693A7C2955EF03E4A6E26FBE1D34C2
                                                                                                                                                                                      SHA1:DD04A3E229D9FCC9998045C43F42983CBC8D488A
                                                                                                                                                                                      SHA-256:8D4C94A621DA05623D7653FA41A28C07DEB2497FB94A4EA61B26E539D1FFAF9D
                                                                                                                                                                                      SHA-512:09EF2F94AF8209FDE3CC16A8F2A438CE1E4DA1177C760F1CD13784DBD69DD1F96BA1F6FBCC1CB772AC1B6DF5833CDB3DEE0128B95D1CEB3C453074F02C49C6E1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/download/start-download?target=windows
                                                                                                                                                                                      Preview:<!doctype html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">. <meta http-equiv="X-UA-Compatible" content="ie=edge">. <title>Downloading Neat Reader for Computer</title>. <meta name="keywords" content="windows epub reader,pc epub reader,epub reader,computer epub reader"/>. <meta name="description" content="Neat Reader for Windows is an EPUB reader designed for Windows PC, allowing you to easily open and read any EPUB file, so you can enjoy reading. It also supports a variety of platforms so you can continue reading wherever you are. Now you only need to complete the registration to get 7 days of free membership and enjoy the advanced features."/>. <link rel="stylesheet" href="../express/vendor/bootstrap/css/app_1.min.css"/>. <link rel="stylesheet" href="../express/vendor/bootstrap/css/app_2.min.css"/>. <link rel="stylesheet" href="

                                                                                                                                                                                      Chrome Cache Entry: 312

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37288
                                                                                                                                                                                      Entropy (8bit):7.994762848094783
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:UQSzY+QT8ixHcLcMPO0iDX5nGViyewu06tKiCMSrCgTFEbg:UQSzJQCLcMPO9X5nGViyej0dph
                                                                                                                                                                                      MD5:156C2C8098F1F956D43EF04E6FC6DFF4
                                                                                                                                                                                      SHA1:5844EF40E7C70C89F8B30E94E3EF7DE57F37BBD8
                                                                                                                                                                                      SHA-256:5A79395E0FA29B172E332D0600B70A3B90D36C425421C16F514D087B50829571
                                                                                                                                                                                      SHA-512:E0722ECA4C570C68D21739F407FC18E5FC3695DA344516EDBAF226FC250F1B989B6B34C2A132D6EB95CC1FD8F04D757E277DC104931C98C988ABA495FA00DA49
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."....t@.D.6..ImL....pt...}q......o.?....{..k...?.'.?...;......._.~}.?......i...../.o.G.....?.?......X.?._......_h.........~..b...........K.X......'..._.t..{....o.<..o.....%>e.i.s..............W...^...=o?........?...........}....w...............G..._..'~.?..o...W.?..._.....~...........!..?....#......7....._.......c...... ..9..;.0..S.E6.e.)....z.C...LD.*.ms..b.V..{+....K.5.....kdV..Mq$..d...X....ET.];JA.(....T9...V?L.Wm..R..V.@...0E;O....xt..b.../|..L..!..vt...To.Ol..i.T%.L....D...4.+.i....}..^.t...7..5..C....8!..}......Z....>4..8F 4..!I./r...|.H}.rLp.....1.m...G..d...f..fM.$.s...JH;&.a,.......E....T$"..W.Q..IP(m...X.....U;.6.S.Ui.z..u.......dQ..t.cd...7...u..6?..d#..7{.o.@..... N.J..i.n.4.VR..,X...A.P.}..c..S$9...Q.$i...97..a..+%.K.....0iP[.4x.<;.@..r.8V.@..JN.{H.:....4v.b._..k...A}.'....Q..Ec.,t.b.z.*d.%.L..n.?.FOao..6M.S...U~.....'.xT..+....1fh..j..v....0.......f.l....V...s...Z..>.4....._.Pv.uQ...7.$...O6.Q..

                                                                                                                                                                                      Chrome Cache Entry: 313

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):244
                                                                                                                                                                                      Entropy (8bit):7.052798134603722
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:c3ZFl0RTz7vgmXhsKroc6rRnPj5P1e32/XGyw7njUvp:c32Tnoz9P432/unjq
                                                                                                                                                                                      MD5:81226FE56259FE6976BC69271844349A
                                                                                                                                                                                      SHA1:2798D1D805F0B48140FABF2A95A925C5CF240AA5
                                                                                                                                                                                      SHA-256:6CD9FDD3B8FDB2DF17D4D09FB17006C8EB39A3DF753D04D541472A4C8E708284
                                                                                                                                                                                      SHA-512:AF656EC82FC287D897A2C227DAF621F593A56FD333BAB0C7E5664A24736683480CB73CBF91515CEA777FD4B9EA309AD6B42EF261D835E8060FC98DA7BD65E3E0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../.....@.$.4P.k.,..V.r.d.+......7.....n..]...fU...ms..../b@_x.W..?)q.Rm.$.6.p.Q-....`..a..._B_.SB..dX.2.....5..97n6....;N...]..{....~.P.N[....j$.!.....$..`W.(q..r.7.G.....lM...........b,....$...aS...3j..A9..<9

                                                                                                                                                                                      Chrome Cache Entry: 314

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):7814
                                                                                                                                                                                      Entropy (8bit):7.949320261275962
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:AQtx6EmgWarlHbvkZNZbVZBYqDr9a2HQqqZB6OkRAd52kxjTfhrM9Aj1K+YsPf2B:Lt+UtvkffNDk2Qgn21rBkAjc7iyQE
                                                                                                                                                                                      MD5:5AF43B884C081DA1170EFB5E83464C10
                                                                                                                                                                                      SHA1:922B5ACDF530941FCF32AD3965EBC1CAA1B10BAE
                                                                                                                                                                                      SHA-256:A4A08FC69DF895D62E3776501B4BFFB76A9128D28CCAA9D5D459D2D711051951
                                                                                                                                                                                      SHA-512:99CE135EBB217EF1371D041F3A65E285F01B6803AEE62509877E9811E5093D3B7B0A2548D6D637FD207198C6C2257ED9AB1ACF38E79FEE31B9968A23AC3E3807
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/MI0aupX4o-83J3FhZILVyrl7WMnBVF9AiMghexepstdhSV6JnaTMgd18YvuFuFdKxBU=s64-rw
                                                                                                                                                                                      Preview:RIFF~...WEBPVP8Lq.../?.....m.9..u...PI.J..AC[.E.k.jM.1.U.{..`.....X...k...$0h.A..H...1S..s..:..<.l#Ir*....L.k.-..........0.....e.s.Yb..J.{/..7.....H..~.3.y.'..L.;.?J...Z3...%{.R..~..c h.61...~..1......P.>=G...m[9.R..>p2.ffff.b...2l...{.Q........c..Z..d5j.D.i.....km...m.6BF..m....s.m....cTO.d..m.Z.m..>....L..9.#'..:y8;|r....x.9z+...m;.l.....9..iR.{..m.m.'.m.}.n.\.v....c........v.I.tr..No./{p.m.}?.m.m.6.l;.6M....m.$i.w..+Vf.Tg..v...m.m..l.vnm...\.....O.(.2......=....>o..6@.D%.Y-i.....R$.b. B.R...%.a...;.f/.b#....~.....'..r<"..iRj .....E.lv.....&.4.+,....C-).../Q..1.$..V.A.6{,.76...N...meS.,.K...?n~._...U..pV...3..@q6......A.~.m6p(X..t0D.B=.y....8R....+.b..n\s.iO(m....2...........h".m...j"X.(..h....w....FP.'.M,k.R..83.....(....<...^k....U..V4{.o\..s..Y.'..h.t..BC..>..Xq..../.'....e..P...7j..`.........=/......|.V8......y...O&..h1H...1 ..8.p.`...._.O.J.PkEe.....0S.EK.@@...#q.......`..J..7...{JP...d.V..1'K..H.n......A*....X.z.%A.4..

                                                                                                                                                                                      Chrome Cache Entry: 315

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):40692
                                                                                                                                                                                      Entropy (8bit):7.995022526542713
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:slf3K5qlwBM1bCgq/s31UfnLjvNNYhqRhEZGrK5add:6FcWbCgCscGqRh+GrKwd
                                                                                                                                                                                      MD5:97952ED4B06D4891FECE3D3C842062B6
                                                                                                                                                                                      SHA1:CFE809DEF314F3D3569FD24ABA48F00001678684
                                                                                                                                                                                      SHA-256:DBEC46F7F8D5F6A8C9F734ACEF8AC317D05270AA26174E2B875EB44A804C10D5
                                                                                                                                                                                      SHA-512:D40E0038A3F3DE00D59DAD8BC46FB400A2EE167E34EEF577EDD0AFE5A746837D7347EE4D2FA99A25BE60955E2C79FCC7CE9AB05AE0AF1F7D666CFB36EAE3786C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/ZeBktiqK-8S2oYTEz32mrfbP-Jo7wRsfBZrbOqvnhL_wwXMNFtcd2XMFWdB9bUr55Os=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ....0....*..(.>m*.E."..;vL@..6.\...2.{.l...W.,..............e...>'.....g./.O.w........e.T......./...o..x....^............/.K...W...?....q=d.....1.u..........._....1..._.?.xK.........G.....}........3.w...?.y#.....>....S.c...../.{.x......}.._._......................g...|6?%.....W..............B......._.r...........g.......m.........+...G.......o7...Eo..h._.?J..-..%.4..Q*.;Y...Wgg.6.f..4Zu$....t.."..Rnsp.}....~..2.&....tF^2.).?6%..g.....7...D...j.g..G.....h..E..X.+....*'\.....}..&...D1..\.*....\..L.....5o>..u..V.....i{.^.........u...)B...!.hI'@M .]......{..uy..z'..3.{...E.u Y.].....=...[..GP.(.E..=.....32`7...V,.K..;..7.^!$PoXv.......K>....p.(......P?O.:..........r..8B0.0.o.pi..t.H.N.H..TX .9|......';[Wv.V...;....SRV~........m.....W..j.L1...&t.f.8..i.w.'.|.@....-......Xza,....3s.4..ykw..5.&.J.%.......(..qt..d....P.....[.vgX.#.2.....Hk.{...[...W=-.j.A.Y..'.q]..i.....u....sb.0...g.S.2-#..".+l.Ku\.VB.D.qb.E.2...@96.v.4.OQ...

                                                                                                                                                                                      Chrome Cache Entry: 316

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7266
                                                                                                                                                                                      Entropy (8bit):7.965279625699612
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:SGUrmQeyPxHBDDDstMt0kPf7bj+vrGK9qie0KpYoI:5U/eyTvsKtFPf7YKK9q70yY/
                                                                                                                                                                                      MD5:BDA17878678BCE9E4E085DB67EEE85BB
                                                                                                                                                                                      SHA1:4A3A2F85987BD5D48C4B1C2F36EE55810C5B31F4
                                                                                                                                                                                      SHA-256:7017FEF114766D00175764DF69A29D357E23AE4FE5E1A3C04944F7102BD85F70
                                                                                                                                                                                      SHA-512:2C9D5E23F012E01FAF42A03D8241F45620C28D5BCDE48A7BD8C9D3D0C23A48D1D6A7135CB8E61713ADA800278D2DFC48FC9AD4D941A32845390D5CB976CE2239
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFZ...WEBPVP8LM.../?...M0h.H.....g|:.....R.#..=..A...6Y.L.m....$)*.J...W..7..Y...\8.........I........bf.....L........$.>..7...H..Y.........*V}...Il..[7;....IZ..G....r*..\.qg5...,.f.6.i....@.6....5D.. d..&...kd9.V..,3......:f;..`.....w.......5|...S].U.7...J...v.....A.......d.).....Y.f.:U.j.vmU}.sn$J.a .@....j.........#I.l+.u...52.D......M..X...$..~..A.4+]..22.h.l...m...l.vf!;..:..s...wlV...AF....Q.m.fv..m..f....vcs.1K...........Z.q9....m._.?m.....1.g.$.4I..l?./..I.m..#"...m..m..eo{.m.>....8.X1..v6.OJ)..P......U.K&.L..."...N.-_.... ;..Gw.:j....!.P.V...Q;.P..Q"...N.v.2.,....y.......\....?..3..@.C.t.........I...(...h.`j..(...%.t.o.R.r=..,k.J..........m..5L5..R(R..M.....P..Xvx.A.&..v...csJ..".m.3.u.{...M4.{.Wb%."ryP..._...;....R..$.l..."Q@:WU>=).v...<.........$&3..T.3[...\....8.$". ..v...3.mi...L.j.9...O.,..AvzD..........E,.8.M...i.....\.qF.e..".'........P...A.X....0.v...p@...AzLu.TD.X...`.....C.WB....tQ.q.5.bTS=.S..ZUB...-..]...

                                                                                                                                                                                      Chrome Cache Entry: 317

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):11010
                                                                                                                                                                                      Entropy (8bit):7.847908168465599
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:SAt0XvYpn0529J+8GO8bIMJbDgZt3rbGTEmMQE/dBW3NMUtbF0:f+8G938ZRYI3KiEJ0
                                                                                                                                                                                      MD5:D80B3ED07283321397DE506D79E0EFCF
                                                                                                                                                                                      SHA1:3A09C0AA0C0AB693203D587EAEAEF2062C0212AC
                                                                                                                                                                                      SHA-256:EA7F2A0DABC5A5ADAF7043D385DC4EE6C64E64256307CEF4EF5FCCDC26E7F713
                                                                                                                                                                                      SHA-512:7022C5593CDBE82F73A9F1DDA5CFB4C51F03A5F30EDEE92B9F1F881A93C028AB28EC43A8D71913CEF2F0700A95DB292EBE8F0419278BCA4F7DE16705460F5233
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF....................................%.....'10-'--5=PB58K9--DaEKSV[][2AemdXlPY[W......./..0W=56WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW]......h....".......................................B........................!1.AQ.aq...."R..2B..b..r.S...#%345DT..................................).......................!1..AQ"2.a..q...............?............................................................................................................................................................}c....O.{.B.(...}c....|.....Z....O.{.@.|.../Z.k ...}c....O.{.Bj.k(...>........w.5N...K.>.....|....ju..j....w...>.....e.O..{.A...X.~..Q...x=G.......W........:....$.....[...-.k.....51.....N.{.A}.}c......t........=...{8.~...5c...|....%{_....5Z.9.M.r_.K...g.q..?..M..E.J_.Jq...4.......Y..TN.\@4{......X...]3...g.=..........`4.....'.'.=..4.....=...u.8.~.T.a...ju.w.......z.`...*}P.....:...i...C..>.w~....T;.A..x...S.;.B>.S.;.A.. m.]N.........i.....{.@.l....i.....j}P

                                                                                                                                                                                      Chrome Cache Entry: 318

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1157
                                                                                                                                                                                      Entropy (8bit):7.690876877349971
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Mmw3/boajKSiTn4mOWTdhZ/XkgtU6TAZPr+QhhBzj8mahn0:K3/bV1iDuchWo/TAZ3vZIM
                                                                                                                                                                                      MD5:EDBE04817F5AE0C3B55EB6817E4F994F
                                                                                                                                                                                      SHA1:AF6B182694C6F43B56103DA7F61A26B58EEF6D2E
                                                                                                                                                                                      SHA-256:6B7192F1710572B19C2A8ED9593A5D5383AABC9FE00325BC932DF7E20D372658
                                                                                                                                                                                      SHA-512:486D9BD54EBDA89117FD95EA9EEEAC14CB142CACFB3D115D1B52359A1773752CCBB4620B8129F5C28B96DF2CF17BEA6CC23143BD7EE5DEAA666C3F4890BCD3C9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....szz....LIDATXG.Mh\U......y..$M.%-F..R5~..(.....)ESp.....A...Z..R....-.B..b;.J.Q(~1M*I...4..GN..$.t&3.n.....=.w....y.e^...Q. ..n 9@2...1&.H$....OE..."..C...`..5.....9..0.m.....s/.....f.~.Y.."...z......7_.G3.vw..G..\../.c.Z;.?@]........G@.\.._.....k.U..B.m..^.......r.......n.(.L>X..s...../.....{?....G.X.1f=.. .......Nz.<f.....)....Frq..DD."....a....N.:.e..........SL...[.nU.e.Z/...D$k..7;;..../.d2a*....s7..|.....O....M.6.S....D..k.6..9..........G.8~.0!"/&..iME........{......r.$_.p..V.ND~.p..o.-...m.$'..{.."@-...j..Z{XD.q....#...3...0==}....w.....'....("...#.....<.=.iQ.q..{?.qD.....C]]]_....&".P(....#....+..CM.".....".N>:.....3::.,........~..kz.ZC..j5#.S*9.$..Ed..4..%)V..8.....n#.uCEHr(.C..N...}...a8...<Y.<..$.{D.....C.Tjbvv.3.H|..*.'2..`....h.U...1....Appff&H&.'H..0e........_......E...8]-.....a.>.N.....QI..I.T,.w.|.Z..J.U.sn..sH.d.".f...1.W..D.G..J..GQ.MD...Q.AD:..Zk...a.E...x....SY.q._.?X.0..dY.H."..dDZTo..S.z.w...J5

                                                                                                                                                                                      Chrome Cache Entry: 319

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1506
                                                                                                                                                                                      Entropy (8bit):7.8355043994591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:bjOqTuObOflLYlKplL/7HjsNXbhE7rYu4IcVIeVzKRL3HhhUpXHpWRbtbNXppFp9:baMuMOflLYKlDsNLG7v4IcV7VGUURJBN
                                                                                                                                                                                      MD5:69920EACA11B70A58900CCC60637F21C
                                                                                                                                                                                      SHA1:6EF345F735C2CDDC9306135B6AC05D25AEC74BD1
                                                                                                                                                                                      SHA-256:D3502D89B76024AB3F37909BEDE1C5E2EDC05F9A2E7BF03BC7BAEEC45ECFE0C6
                                                                                                                                                                                      SHA-512:7F4AF4EA28139FEC3CE2061281756D2CDE63DE9062C08C063F2FE922744302C47CF1DE032A8935602BED913EE79654D0A1AD3B22B53A6EFC31ECDBF477052276
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/nR_05gPEd0TEsjwBftKhhJH9Nfxt26H0DdM8zWNuP73yHxJYggBRaidiiEkokfIWit96=s64-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../?...&:......m...*.m..m.m......9Y..t..U&.@l.).-w......Sf...:.@f.3.....*....Ef...p..6..sg.9.....l..#.c..g[....;. #]J.B.k.f...m[.m..![....l.Ij..l.m.m....}3?....a..u/C.....e`..vtt..@..0.....I....`...c..(....&..7.....P...)p....i.....i........-..Y-P...asW.......2.f.q...{.W../;.m....<...VD.k.f..+.VJ.....nF.@.P&...A)PR](..vj.......$H8...._.3c..y......_S4o)/(..-...-p.....{h..M`.%Z..!46u...=.4...'-Ru.M>.0.HdKg.|.=...>;B+:y.@.*..S...D..?./1...m..".................2...i.'....U.....0....XD.T..M.:3......d..%.^^....V..m....w.f...^.....P...F."jo.....Zw=..(.ey.......]...W...c...`.M..n...u.h.dv.."..u..~..C.I*..Y.=8..........I.zn.......uiL.I.6r....rJ.d.>.....Tr....?;...z..*2..-.y.z.....7.8.WJy...7......J.R......f?.T.82..[.y.../..[...7..=.......(.S..$.$L...G..........L....@.M..?...!dA..F..*..u..Ca....-~n.{LB..I..d...t.....u...v.f.df ...f...hL.......@=4{..;..k.....9b.;t ...W...........Z.e.c3..I.1.E.....=...gd./..Q*V..Nd.).oF..7~q.

                                                                                                                                                                                      Chrome Cache Entry: 320

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):4.639719888612948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:EdAdhzUooooRoooT0oooooHooooooovqxoooooooooA:EkLL
                                                                                                                                                                                      MD5:A217F758EFDFFF14053678DBE58FA4D0
                                                                                                                                                                                      SHA1:6E0EB512C2F386D645712D7ECBE339EA85CFCA68
                                                                                                                                                                                      SHA-256:F343B3015D0545A7D5B719A434135BCAE2AC766ED459AEEA671E3688B79D1875
                                                                                                                                                                                      SHA-512:9BCF90FED875FFAF3170EF3425949642EB23B4E750CD42BA546D30E1A58C4FEE1A14CCDBD31455A6A442D09372CCB3873BD7477A59853608BC87660FB578119F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................................................................................................................................................5C..5C..5C.]5C.5C.5C.`5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..=/..$l.................................................. <../A.8D..5C..5C..5C..5C..5C.:5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..=/..$l..................................................TN.(?..'>..8D..5C..5C..5C..5C..5C.5C..5C..5C..5C..5C..5C..5C..5C..5C..=/..$l....................................................2..l...8..&>..8D..5C..5C..5C..5C..5C..5C.5C..5C..5C..5C..5C..5C..5C..=/..$l..................................................../... ..m...8..&>..8D..5C..5C..5C..5C..5C..5C..5C.g5C..5C..5C..5C..5C..=/..$l...................................................E...>......m...8..%>..8D..5C..5C..5C..5C..5C..5C..5C..5C.?5C..5C..5C..=/..$l...................................................B..C...>......m...8..$=..8D..5C

                                                                                                                                                                                      Chrome Cache Entry: 321

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (31803)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):31904
                                                                                                                                                                                      Entropy (8bit):5.464187984108645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:aCn0VmiVxAtMTvnSr4l9d+eawJubAw5qHm6oQnYxZGplj:aC3iVyeTvnS87dsSuJqG6hnYxAj
                                                                                                                                                                                      MD5:017385B552F7E0D979E2E2FE6F324015
                                                                                                                                                                                      SHA1:F89BAD36F939A1D885991580CEB064FC668DB7A2
                                                                                                                                                                                      SHA-256:78FC260A16DBBD76EC3B4DA56CCDC7A076D21D31C501E0A17A4175C4A25D95EA
                                                                                                                                                                                      SHA-512:D91E152466A606E769CC2D4D4DA4A4BAC5CFED0922518BC42A1A490317950AA2C3B205B83AAB73A2B646A6E944DDE100EE9FBE5346589AA0703B79BE4768518C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/photoswipe/photoswipe.min.js
                                                                                                                                                                                      Preview:/*! PhotoSwipe - v4.1.3 - 2019-01-08.* http://photoswipe.com.* Copyright (c) 2019 Dmitry Semenov; */.!function(a,b){"function"==typeof define&&define.amd?define(b):"object"==typeof exports?module.exports=b():a.PhotoSwipe=b()}(this,function(){"use strict";var a=function(a,b,c,d){var e={features:null,bind:function(a,b,c,d){var e=(d?"remove":"add")+"EventListener";b=b.split(" ");for(var f=0;f<b.length;f++)b[f]&&a[e](b[f],c,!1)},isArray:function(a){return a instanceof Array},createEl:function(a,b){var c=document.createElement(b||"div");return a&&(c.className=a),c},getScrollY:function(){var a=window.pageYOffset;return void 0!==a?a:document.documentElement.scrollTop},unbind:function(a,b,c){e.bind(a,b,c,!0)},removeClass:function(a,b){var c=new RegExp("(\\s|^)"+b+"(\\s|$)");a.className=a.className.replace(c," ").replace(/^\s\s*/,"").replace(/\s\s*$/,"")},addClass:function(a,b){e.hasClass(a,b)||(a.className+=(a.className?" ":"")+b)},hasClass:function(a,b){return a.className&&new RegExp("(^|\\s)

                                                                                                                                                                                      Chrome Cache Entry: 322

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7814
                                                                                                                                                                                      Entropy (8bit):7.949320261275962
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:AQtx6EmgWarlHbvkZNZbVZBYqDr9a2HQqqZB6OkRAd52kxjTfhrM9Aj1K+YsPf2B:Lt+UtvkffNDk2Qgn21rBkAjc7iyQE
                                                                                                                                                                                      MD5:5AF43B884C081DA1170EFB5E83464C10
                                                                                                                                                                                      SHA1:922B5ACDF530941FCF32AD3965EBC1CAA1B10BAE
                                                                                                                                                                                      SHA-256:A4A08FC69DF895D62E3776501B4BFFB76A9128D28CCAA9D5D459D2D711051951
                                                                                                                                                                                      SHA-512:99CE135EBB217EF1371D041F3A65E285F01B6803AEE62509877E9811E5093D3B7B0A2548D6D637FD207198C6C2257ED9AB1ACF38E79FEE31B9968A23AC3E3807
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF~...WEBPVP8Lq.../?.....m.9..u...PI.J..AC[.E.k.jM.1.U.{..`.....X...k...$0h.A..H...1S..s..:..<.l#Ir*....L.k.-..........0.....e.s.Yb..J.{/..7.....H..~.3.y.'..L.;.?J...Z3...%{.R..~..c h.61...~..1......P.>=G...m[9.R..>p2.ffff.b...2l...{.Q........c..Z..d5j.D.i.....km...m.6BF..m....s.m....cTO.d..m.Z.m..>....L..9.#'..:y8;|r....x.9z+...m;.l.....9..iR.{..m.m.'.m.}.n.\.v....c........v.I.tr..No./{p.m.}?.m.m.6.l;.6M....m.$i.w..+Vf.Tg..v...m.m..l.vnm...\.....O.(.2......=....>o..6@.D%.Y-i.....R$.b. B.R...%.a...;.f/.b#....~.....'..r<"..iRj .....E.lv.....&.4.+,....C-).../Q..1.$..V.A.6{,.76...N...meS.,.K...?n~._...U..pV...3..@q6......A.~.m6p(X..t0D.B=.y....8R....+.b..n\s.iO(m....2...........h".m...j"X.(..h....w....FP.'.M,k.R..83.....(....<...^k....U..V4{.o\..s..Y.'..h.t..BC..>..Xq..../.'....e..P...7j..`.........=/......|.V8......y...O&..h1H...1 ..8.p.`...._.O.J.PkEe.....0S.EK.@@...#q.......`..J..7...{JP...d.V..1'K..H.n......A*....X.z.%A.4..

                                                                                                                                                                                      Chrome Cache Entry: 323

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3089)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):69640
                                                                                                                                                                                      Entropy (8bit):5.428026405432715
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:8Rx5xxd9L0ngo2qQmDVeClRhw7d5i8q7nXxaFuYPdZIJVNfOT/BhqxlWZ:8j1dF6goxVe8vwiUFrdC2T/TwkZ
                                                                                                                                                                                      MD5:F713EEB3B0A890A92D79B1B20AB97B0B
                                                                                                                                                                                      SHA1:0262AD1062E4FC48562B58619FF2259F337D118F
                                                                                                                                                                                      SHA-256:34747B2688FD1736007211CCCA2276A7C23F05228D1C4B5C2D4D239DDDBDFD14
                                                                                                                                                                                      SHA-512:2B99EA22E50A6AF7988C5670411795A093A8CA25352BD881CC44FF141985C521FDFEA104F64F57B9A5C5572404516780D31CFC0D411B61DB1566020AA924068F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.gstatic.com/feedback/js/ghelp/16uafg9rapvyz/chat_load.js
                                                                                                                                                                                      Preview:(function(){'use strict';var n;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var p=ca(this);function t(a,b){if(b)a:{var c=p;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(h){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(h||"")+"_"+e++,h)}function c(h,f){this.g=h;ba(this,"description",{configurable:!0,writable:!0,value:f

                                                                                                                                                                                      Chrome Cache Entry: 324

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12920
                                                                                                                                                                                      Entropy (8bit):7.977885299498505
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:BcqMdTJJGnG7bXB+MC2dvOkz5D0j7ZlbWVm6MYKJ/j6BQGjosoQ3a3hF+FJW9JoE:Kdb7rCsBFD0/bUfU6aGjfoPxF+zEUt0
                                                                                                                                                                                      MD5:2A2394A3DD133160376C9B4758B3FE68
                                                                                                                                                                                      SHA1:D8E040D53649C46B3939B07C5CAAF0C82268CCA9
                                                                                                                                                                                      SHA-256:86ECA579F61CDF7E3DF641A081FFF80D9D21F9D7ABEC40DE962653D19BEA6484
                                                                                                                                                                                      SHA-512:61FEBDE89F6BD3910B629DC2468157D1CEF24DFED9DF02F083C0276C5432B48E2361D634EBE7AD73DA62DECB2B7B1B76A5348466263A8CDE8383F157AECB8122
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFp2..WEBPVP8X........)..W..ALPHg....w`6..R.(S.b.....<.5.....&kN.?k"!4....P.........".?....9.Z...v.bvI".........?..........h6....d.vI.;dS.VP8 .1..0....**.X.>)..B..!..5x........k].r.,...F.0.$....mxW......?7.....*..2..l........?s?......?..'......?G...R.....'......k.@.$.y..._.......?...~......3...w.W...O.......}........).......o...O..........}@;A.\...%.....S....E.i...Y.......p..........................?.~..v...i.Q...z.z......?........u.?....R...k.............?........?*.....y.+..........?....c...;..........5..._._...H}..0....................Y.c.....W.yL....(.2.60....w...%-.....Ss.....#*....e..<v......!....yc.........T......rm......Nkh..F.UI.A.......8zK........<."..3...Mi..}l.}1..w....Tb.y.p..~...%..c&5Zx.P.........Z..f....+...z@.a..F...EM$.{..3y..0I.....}~....t9...t})u..M.....h..(.2.68P.e.lp..wn......./.0}..J1A.{.e/...nA^.jQPy.b....8..I./...=q.X...s4.M.-N.....{....w.n..1?{.~4n......Z....4-tI...|.C.Q..73......f[W..4.y....G".@.P.V..OX.R..prH....

                                                                                                                                                                                      Chrome Cache Entry: 325

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (967)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5561
                                                                                                                                                                                      Entropy (8bit):5.6424838842644505
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:kGn9IaCZPU+KXtBAXeKqFUvJcyQ8TILf4K/IEvInl:jn6aCZPPKXtBAbqFUvJ+8TK4KfAl
                                                                                                                                                                                      MD5:42A6D513E0331BF8568D7D426E9E5F62
                                                                                                                                                                                      SHA1:4F84F554F55BB53EAE3AEFA0FD9E10DDC7C48353
                                                                                                                                                                                      SHA-256:D2DAF09C61F8E03765F8AE0C3F594C3D37BF53E50DDF416BDC4972427B6C1372
                                                                                                                                                                                      SHA-512:D3ECDC18F12641194EF555F13EBF27433D68B372FA7B368387EF64184CFAD2FE2CCC5DA3258AA49A9263F46AF5DA0627A229B6FC963F661BBD3312ADFB6CDAB8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.tDa=_.B("lDZ2Fb",[_.or]);._.u("lDZ2Fb");.var gcc=class extends _.z{constructor(a){super(a)}};gcc.prototype.qa="K4YEGe";var hcc=class extends _.z{constructor(a){super(a)}},icc=[2,3],jcc=class extends _.z{constructor(a){super(a)}kb(){return _.F(this,_.$s,4)}},kcc=[7],lcc=class extends _.z{constructor(a){super(a)}UB(){return _.F(this,_.B1b,4)}};lcc.prototype.qa="swBvle";var mcc=[2,3],ncc=class extends _.z{constructor(a){super(a)}},occ=class extends _.z{constructor(a){super(a)}};occ.prototype.qa="XMKGyc";.var pcc,qcc,rcc,scc,tcc,ucc=function(a,b,c,d){var e=_.zW(c.kb()?.H());const f=e?"3121|"+e:"3121";e=_.X(h=>{_.fh(c,_.Ng(c,icc,2))!=null?(h.open("p","WcV9v"),h.ka("class",d?d:""),h.V(),h.print(_.L(c,_.Ng(c,icc,2))),h.close()):_.Og(c,_.gt,3,icc)&&h.print(_.xW(_.J(c,_.gt,3,icc)))});const g=_.PN(h=>{h.ka("target","_blank");_.QN(h,_.NN(""));h.ka("jslog","197536; 1:"+f+"; track:impression,clic

                                                                                                                                                                                      Chrome Cache Entry: 326

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):8702
                                                                                                                                                                                      Entropy (8bit):7.956417927660698
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:TfSd8DtTZBu2squcLPxtmC2OjVinln1qyfIw+HB3F5TWD76:L5/NlGOZiVfr+HJen6
                                                                                                                                                                                      MD5:A4A0F7723EA33D4DDB9720848D061F7C
                                                                                                                                                                                      SHA1:DE5AB146AE1A8EB09E0B698F27F7E8992303B3C8
                                                                                                                                                                                      SHA-256:C25077C72ED395A1752632F47B6A65D9BE564267DD388C852EDA513F26C480C7
                                                                                                                                                                                      SHA-512:F458B1C9D2D68BF70DFF9D542A999729DA4A1E41E3546E111A1F56FA0DA0F4ADB55AC942B25BE08683BF6D479B840388AB15BB6EF04DB511B770CAE23A789E19
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/sqiP1qM7wG2bNZxazEogFapaGlhLWbYz_NI9BHCvNEe15mGtC0OYRQKYbdt_yD4pdSM=s64-rw
                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8X........?..?..VP8L.!../?...M(h.FZ........<jb>v..fF. ......W.`...CP..1..D..*r...W..H...r.~,...'ww....H....".....E..K..?.L..Av..{..(.L{..YiA.[.*6.i.....).2...^.=TB..F.#.fY./Go...}{.V>o.]...W.iR].....)..,........W.....<n..J....WU..n.i x .2............$.nq.@...o..hU.F........C..m;.....h.e_6.y]..n...m....$.I......y..mq........J&..4:.<....y......dff....LN..tb+.,...B..HM..8.'.........x.......p.=.{.?5../}......."[............N..RXNII...~.[...;...}..".B.Oim6>....S.?.;X.T.x....?......=..\..^..S.r....b.|...'...p......Nz..^...i..z..i9...@...T......a.|.[m...U..1....b4.+.=.!.x..U"..g.....3E...O!.r. |..X...@..GPDA..a.....|..CJ7p.....%$[..?....?.Y.a.#.thk3...kF?.nfS..v..z.....K=...b,.dwO..\(.|.-.q..2.........$..a].5..q5!!..R@..>Wn...d......>.5..SY.Lr..lY5,..y....._]..B3.H.75y...J..0.......h.'H.u..I.....VM..Et#.......@"H.ZDj....>.Iu=)5..|u.Y..x.S..}..& .5...e.*.s.3OU..uH...>.....%-M.>...P.0@.\...A0.(...A.W..._..f>O.0......^.d..j5..

                                                                                                                                                                                      Chrome Cache Entry: 327

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2082
                                                                                                                                                                                      Entropy (8bit):7.87795866691455
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LWUAnnDlwaERw+VemOolsOLibpFBa13+L5nJhCSHIF:fAnhwaERLVewlT0bo13gPhChF
                                                                                                                                                                                      MD5:634D682439A142B3BFE3C14C5C332ECE
                                                                                                                                                                                      SHA1:470E0A4FE836F9A10B5A595BF324C06418D276D2
                                                                                                                                                                                      SHA-256:1FBB0E1847A541C90E8AA181EE47D1FE0B5C8E3018BBBD5B7F9127704206AD04
                                                                                                                                                                                      SHA-512:DCBFF2D01E80FEE7D5CB79F61F23121A0F457DACCAE8DC2B1224B1906C835E0F23399C762122A7CA1A1C05FF3F94F843C618F5C594B8E36DB223E41F3B11823B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../....M(l.....#.."._.....@.F.?.Y.5m#17?......m..]...k....N,.....{ |......J........ED*.m.m...^.=+.m.e.*..D.{O.l[.......]=.#..1.....R..)C&.+.p...#Ir$;.Y5.{..!...ZQ. .........i.0N.{I.&iV......2........7..s.(b;.v...HE...!."A.@.C*D...(L.".#AX..?.]...).p.vD..... Jf?...w.wj6_:)I.d...)..!..<..#K.R/n.. B`...H..v..Un.i....._..;.....@ d.!.1....024w~...-... B..$..S..P.......3....=I`p.....I.z}...(..S>..B......x.........B/.......2.$-..r..`....K..@...1..b..r.."..1..7...@...}.on.Z...0d|.A.....a7b....B.E.k.U........F r..5.zo./..1.7...i9......*..."...jM..T...]..>Y.sCeH.%.8.o..ws]..!.!c..=..{w...@@... ..@5`}...C1...!.E'9...^/......WG...T.?..~....g.Ji..........2C3.Wg!=r<z.3[..n...mx.ZE-.U...S.ZU.MqxA.....S....'.'k..........3h........t."V...?5..K.HY#.d.uyn`...[..c.x...y.O)6........>......A.*.S@ZT....t.6}.....h..S.g...L........lN". .2d."....@.@!\....."...7..0.d..__..........W..^o<....-....CDH .p...T.$......nz..x.........t.A....s.3.........

                                                                                                                                                                                      Chrome Cache Entry: 328

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3866)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):19130
                                                                                                                                                                                      Entropy (8bit):5.429312887800645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:FfdMN9U396cXU+259cL2YQJ2c7q0bI2z9T01PIAM9b3YeV26HTnPzfQf:x396cXU+2Tc3Q8c7q52z9o1PIAM9b3Yf
                                                                                                                                                                                      MD5:F0CE7653EABD44ACAAF5C7F04EB432F7
                                                                                                                                                                                      SHA1:7845DA90B09EC0567576DF3D369BD97FEB3869D8
                                                                                                                                                                                      SHA-256:04B6C36A889187DA8F0335539D66D0684C1AA13DF5F627F0C2A4871463B31968
                                                                                                                                                                                      SHA-512:8776FF504B5099F2EA6AEE3279DE919252ACDE91DB9F3AD8149EAD4711D3EE2D8E4506AD8F683E733B9B14F54E263D7D7CE33EE6374ADD612D6FB7DE0B0AAF3D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,EEDORb,EFQ78c,GkRiKb,IJGqxf,IZT63,IcVnM,JH2zc,JNoxi,JWUKXe,KUM7Z,L1AAkb,LCkxpb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,QIhFr,RMhBfe,RQJprf,SWD8cc,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,gychg,hKSk3e,hc6Ubd,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kjKdXe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pYCIec,pjICDe,pw70Gc,qfGEyb,rpbmN,s39S4,sJhETb,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xQtZb,xUdipf,yDVVkb,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=RqjULd"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.$K=class{constructor(a,b,c){this.key=a;this.defaultValue=b;this.flagName=c}ctor(a){return typeof a==="boolean"?a:this.defaultValue}};._.u("RqjULd");.var Obb=function(){return Nbb??(Nbb=Object.freeze({je:a=>_.wd("iCzhFc").H(!1)||a===-1,environment:_.fi(_.wd("y2FhP"))??void 0,vda:_.fi(_.wd("MUE6Ne"))??void 0,Zq:_.fi(_.wd("cfb2h"))??void 0,Ml:_.gi(_.wd("yFnxrf"),-1),jZ:_.Nq(_.wd("fPDxwd")).map(a=>_.gi(a,0)).filter(a=>a>0)}))},Qbb=function(a){if(_.aa&&_.aa.performance&&_.aa.performance.memory){var b=_.aa.performance.memory;if(b){const c=new Pbb;isNaN(b.jsHeapSizeLimit)||_.Eh(c,1,Math.round(b.jsHeapSizeLimit).toString());isNaN(b.totalJSHeapSize)||._.Eh(c,2,Math.round(b.totalJSHeapSize).toString());isNaN(b.usedJSHeapSize)||_.Eh(c,3,Math.round(b.usedJSHeapSize).toString());_.G(a,Pbb,1,c)}}},Ubb=function(a){if(Rbb()){var b=performance.getEntriesByType("navigation");if(b&&b.length){var c=new

                                                                                                                                                                                      Chrome Cache Entry: 329

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):16157
                                                                                                                                                                                      Entropy (8bit):7.932926875832688
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:r5upNQivITZNsbPTJ949bKll0Dl2cRhShvYKkkrMidnDI/guG/8bEwqcUM3GlLhx:rY3vWcTz49bOluShHtrUSw3x3G/x
                                                                                                                                                                                      MD5:044092FBA99A51DA431A8A79888A316A
                                                                                                                                                                                      SHA1:4D83A9B18A7FDC12B932638A215575721A2F6187
                                                                                                                                                                                      SHA-256:652844DA329612F397FD4753D6C41D8048D3B8A32D9A7A3125EC1D3CC42B274D
                                                                                                                                                                                      SHA-512:EB4BAA2635C51D912927003F746DACE42B5E5364B11F8C0E5CE724E8BF1736DD05F393479EC97CD919431CDEC10EF917F6AC28F23EB2B090C409224D4D0998B2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF............................."%% "".(%% %.'10-'--5=PB58K9--EaEKSV[][2AemdXlPY[W......./..0W=5=WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................H........................!1.AQaq.."2....BR.....S.....#Cbr..3......s...$..............................*......................!.1AQ.."2aq..B................?............................................................................................................................................................................................n.7y(.F..T...k.]V:...n..O.......^.U5MV"...R.......R..........}...^...4z.j>..y..*j.y./L=..}..y..*......=....O........?.R....,...E.<....^.>...?.]........Dy./Z....3.g...(..........O(....W6...............<....\.~....G......}..". ..?W.................{....l...E....l...D.A...<...Y....#.?............].>....\?...l...Ev.y$/T.@-c...y..*S.....P....^i....Z}.>.U...O.G.w.........}.>.U/.W.Q...k.!zo.{W.P....B-_iG.....!z.z!h..

                                                                                                                                                                                      Chrome Cache Entry: 330

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 1520 x 885, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):57497
                                                                                                                                                                                      Entropy (8bit):7.738115415295803
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:vJ6sZayz2pig7w5EZ9kq+Th3cBkcFjV5GQyIdRV8x4aW0l+EaJTjYmRRy:BVZP2pn7waHB+ThMyc1V8WRVY4eijYJ
                                                                                                                                                                                      MD5:D83873EEDD48CB4D873D454BD796AD06
                                                                                                                                                                                      SHA1:18A9A2BBF59D521BE18EF40A5393C2AAFC6D8CFE
                                                                                                                                                                                      SHA-256:2A623E93009C3FAB8821099DC04C11E35330B6B56D9B68A5788788644AF307F1
                                                                                                                                                                                      SHA-512:0DC14C652A923BA9F835F103C7DFC036E7E6999FE957F2EA78030F1C855BD26DD5869BF589974F3721C13FE2A0FF28C930A4024625285626B4373B325399368E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR.......u.....0..&....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^............<.>w...{.qc.?.c...3..xc.{......a..z.H!Y.j!..e<B.).H..-.0..$..j.$..6.%..@..A....$.i...*3..9./U....O.'$...dVv.|*;.................>............B.............@...........................`.!............. .|.........................0.................>............B.............@...........................`.!............. .|.........................0.................>............B.............@...........................`.!............. .|.........................0.................>............B...'./..g/....E.$.........@y..rE..(.....o/...p.so....5.e?.|.?....^.g.2............'..rY^................?.$..P..7^....)^..@...........>A.........t<U..../^...$...|....E.O|.!...|...............o\.V..t.e..".l..o6.]...g/.K.r.;.|.K&.]...o..j................on.....I5.e.W...........|.Kym.g.ug:..}W...9...y.o.#t.{d..x.ZxO..[g.m.x............0T..........e:....0.'.Iv.e.3~}.Dn.~.

                                                                                                                                                                                      Chrome Cache Entry: 331

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1196)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):7496
                                                                                                                                                                                      Entropy (8bit):5.470932318854405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:qQHF1mUAyTf7OuMJwY2LxVLpyx0y6y+yzySydyQajl3cdhOM5zyzPdiu4F:qAlvTyr2l3LptPnoXC7apcnNzmc5F
                                                                                                                                                                                      MD5:45C20EBE56AC361A05D579CFE0153874
                                                                                                                                                                                      SHA1:DD55ED7E8F25020AAA9828C56F9630139A5B16B0
                                                                                                                                                                                      SHA-256:460AD1280B072B74D65FBF28B3D1564DE979F116F799FECF70EA5D267A51239C
                                                                                                                                                                                      SHA-512:C0B753FD72E20754C353892F5520C21260FF423A53EC5193798AEE7727CCEA62C3006961209A537838CEB930FE18593B6D642EB4B629433A3A031B4F6B8EDDDE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc,t1sulf/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=JWUKXe"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.zMa=_.B("VNcg1e",[_.ek]);._.u("VNcg1e");._.xFb=class extends _.Cq{static Ja(){return{lb:{soy:_.Ws}}}constructor(a){super(a.ua);this.H=null;this.ud=a.lb.soy}};_.Dq(_.zMa,_.xFb);._.w();._.AMa=_.B("JWUKXe",[_.zMa]);._.rf(_.Dj);./*.. Copyright 2018 Google Inc... Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXP

                                                                                                                                                                                      Chrome Cache Entry: 332

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):510245
                                                                                                                                                                                      Entropy (8bit):7.995625251723109
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:Rxr8A4hW7gYykS3SUmXt/vV6FrlJIkBZ7NkXQU+fSqzSeqKZdM85t+knSImSNRGU:RWAcW7jysOFr4A7Bq6SeqKZdD5nSImK
                                                                                                                                                                                      MD5:089695A45226B2DC6DA578927E1C7689
                                                                                                                                                                                      SHA1:C0C3B7232BA87DB311CC058835BE802228540CCE
                                                                                                                                                                                      SHA-256:25F89C2BE83A05876759CAF2DAA4FC9C2C2E77436D88922AAA9D33950DC50AF0
                                                                                                                                                                                      SHA-512:817AE5F1159038FED672611CDC3F481AA406473886643E0106233E31D1417A486CC5E42D17D5572D508D6544E0BD29A9C71493294B51219D2C95E80984C8A2AB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-games.googleusercontent.com/vp/mp4/1280x720/PqMlpEa_N0A.mp4:2f81c81735e2e0:0
                                                                                                                                                                                      Preview:....ftypisom....isomiso2mp41....free....mdat.I.B.O.,.28$............_._............#.~o..?..}...o...7..>;.~...6.....~..u.].:.c.>...J_.:w..^.h..}^..;..{O].}w.../.u.5.zw....t..x.+............uO.=^...R.o....f.........._......?.zOE....._I.?'.._..._K.....?.z_K..'...F....}#..}...n;'.z....7..>.]/G.O..?.z.K.|.._...b....~.....3.<........|S.7#.<.b0Z.L.....X.l..1?.3v.V.@....k.e.k......ljmd;i.1..S.&.bF.Z...z_.....a...PI..n...{.T..\a....i`.....QI"##...Y_.....p....K..7..#R.{A.K......v........4.cCfl..=...K.:.0..%._i..?...a\.q..{...Yu.-*....p.6.*....w8..\.Y.P.E.*T.....'.6..s.... d?...2..f.. .......kycF...l.G,.[... .o.!..;.R..O..Vq....@{f.).....%.]...~.z9.[x....<.% ..C.3.Q..{..=..6.f.E...;...J.u.yUc._.8?H..o.........Li.K..$U....i.W.b......|.....l.R...y.0..H....Z.........]:V....B&:#.z.....YN....C.....K.0.Kk..2.Y.[..V&..!O......T....U..rI.(\.~.Q.....hs.,...I;e&.-.)T.G....YtI.....}.8.....c.4.3.N..Q.N...Re.......d.]...:.......,.<.~...c.=..3..V(...D...q..\:

                                                                                                                                                                                      Chrome Cache Entry: 333

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2279
                                                                                                                                                                                      Entropy (8bit):7.8586454360102564
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:tYdz7SIhffiZAdEEOUHqoIDCB/hailDB7yOqtJ:Sdz7SIoYHONmB0G2J
                                                                                                                                                                                      MD5:767DF8EF75C1C7BF716016B70583E413
                                                                                                                                                                                      SHA1:F9601C0B124D352E01B6DD676CF4C974022ADE44
                                                                                                                                                                                      SHA-256:9C0142625701BC4983F37920457FB76DF0CFBB338CD818872B47B468450CA179
                                                                                                                                                                                      SHA-512:7A4AAB3E41FF26F37F085BC0D70C9B1518E92344A5F786630C7DE75DCDEDCD6BECCFF228634648EB81F1F162F229C8784B56B8AD53F540EFB664AD2140DABEF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/web.png
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD..............IDATx...O[...?.slc......IC..o.].vM.5..:-.U.%.I.6i.E/.wL..v7....F}.....v.H.iD.!.%$!.1...s...6.&.............}... ..B.!..B.!..B.!..B.!..B.!..B.!..4.:E...Vl....B)..B@~=.e.(.{.......7.~.%.p5...Bi.k.\....!.z...v.}....W..T.P.....?...X....d...l&....*.r...f2.LP...D.^...m.S.P"n...Q#.Y..pwr..Bi......T.i....bq.|........P.....>gd...}A.lE....P.4L.T...5.u.4...i._q .a..h.m....$....Q...X.D.m{.D..j.....X...Kl[G]R..H.T@>r .H......R..@5.0)H...e..c....B.@jaja..^........"....D9P...4^..MDr ..........-.....B!:.[0..W..."..cI.....L_..bP]?t"...{..K..#......u{.8.k../.T^...N....yMp.g....aq...O.......x..]Of...`..L...?cs...).....;..cx6.....g....`._c....@@............).p....2|...C.eh.._...6.s..>....[{.kE.#..7w@...5...L.Caq..k.....&`.>...2P.;...+x{_.s.....Z.A,.~.......u....._...%...n.W..R...O..l...I..7.Z~...A3...C...vH.q..9.c.B...^q.S,@K'...9........0}......k.&....a.s..!$3p...w.&..........d).a.6$R......n..-....9..0}..s..

                                                                                                                                                                                      Chrome Cache Entry: 334

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 36, 4-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):185
                                                                                                                                                                                      Entropy (8bit):5.9780303893393345
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlSYLl+1IHCRsHrXLRa+dn/23rIIGU5thNnkncm3w4qtmkW7PXl0VMa:6v/lhP0YLkyymvVGtjnUnRq0kW7N0xVp
                                                                                                                                                                                      MD5:07505E9DAC6DD922116F038EB58C9B88
                                                                                                                                                                                      SHA1:4DAB9005E4603F76A6FAD92FE78FB9C92D05B62F
                                                                                                                                                                                      SHA-256:C4DB75F643BB4DD47E39A9601FCC0A14621B588D5E4EBE987EE4828120BDE791
                                                                                                                                                                                      SHA-512:5A94B97148037E9A25AF768AF67A1AD5D4959E5D5C216DC5353FB159630302A74A990CCA20F787C024C6B7229A12920B287A88A4063514FBA534E7D1DB094C11
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...0...$.....=k.9....PLTE"u.#t."s..OO.PP.OO.........o.......tRNSJ....J..J.j.\...DIDATx.c`T..ec$.. .].A...1..Z..!..%p.A....H...0......*.....]...Qp...al.....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 335

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1384
                                                                                                                                                                                      Entropy (8bit):7.132187656560753
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:hffamZAnlD521IDX3mVIiWq6wYeN1/meriF7sK/ZkioRQnAIurCdUxgz4f95Xy8E:5fbyoIoIiWq6rOc7fFQedUxg01Fy59
                                                                                                                                                                                      MD5:5B0A0B21D5BBB147049D8C1E5D0E36B3
                                                                                                                                                                                      SHA1:4657B6FFEAF84B964F2F032E15D927F2D5F02777
                                                                                                                                                                                      SHA-256:CDF696361687ADB4CD8B0C7501ED6093721961E7A7E0BEB5304FEE812C947BFC
                                                                                                                                                                                      SHA-512:DA431DBCE84354E66A87080432823C739848B5B9948B89D31630693BD0354CF9A9B8AD1C1377F0AF735389EB66F4569497DA46E585A72094558A52683143E7D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/render.png
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@.............PLTE........................................................................................................................................................................................................................................................."..#..$..%..&..)..)...../..2..2..3..4..4..5..7..7..8..;..<..=..@..P..U..[..`..g..j..o..v..w..{..~............................................................................................................................................................................................k...QtRNS............ !"@BJKLMNOPRWY[\hijkwxz{...................................................bKGD...-.....IDATX.c`.................;...Ul.7 .?[e..u3.Z.l....".............h..`.KH......G..v.....&.n.l......8c.n.Q.....M6..LY.....h..M.........!..o....7.......U>q...0Z...k@v....#......V..]T...K..hK..!h.R~.`.W......|.D2@........RB2.K&X_...Y...^7o.....r...t}Tppph1.....u1..?DI+..sr..{..{...g`Q..7@....D...w..@.n.:.Pj....._

                                                                                                                                                                                      Chrome Cache Entry: 336

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):78840
                                                                                                                                                                                      Entropy (8bit):6.022413301778022
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:OfGNbFoZJSUYOOaLnAW8+IcTOIlbuhXwW4nxM:mGRFauOxLA/+IcTOjX/
                                                                                                                                                                                      MD5:0CA290F7801B0434CFE66A0F300A324C
                                                                                                                                                                                      SHA1:0891B431E5F2671A211DDD8F03ACF1D07792F076
                                                                                                                                                                                      SHA-256:0C613DC5F9E10DFF735C7A102433381C97B89C4A26CE26C78D9FFAD1ADDDC528
                                                                                                                                                                                      SHA-512:AF70C75F30B08D731042C45091681B55E398EA6E6D96189BC9935CE25584A57240C678FF44C0C0428F93BF1F6A504E0558BC63F233D66D1B9A5B477BA1EF1533
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.gstatic.com/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/styles__ltr.css
                                                                                                                                                                                      Preview:.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

                                                                                                                                                                                      Chrome Cache Entry: 337

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (785)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1371
                                                                                                                                                                                      Entropy (8bit):5.333014430130814
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:kzyAq1JWvJfRFbtWWS/Cud1QXo9XjIc/Gb0FoGb4vbpAvcEJ8TkT/t1GQ3Qlrl:ky3evJbJWx3XjIc/Gb0FoGb4TpAkE7qT
                                                                                                                                                                                      MD5:E6D167AFFA383ECA133AE1FFA2B5C19A
                                                                                                                                                                                      SHA1:9B2F74DA5D9EE21D512538AF44588C9BA168B658
                                                                                                                                                                                      SHA-256:518F94797177FE1FE3299E4C20DE8D7D33A2C84A1F2C05D4BACCAF998D28EEB7
                                                                                                                                                                                      SHA-512:050BD849075DBB4771C34CE824692225A7EDCF63AB2435FB2527665A1891FAFBF5BB93A896998A92E4DBFB95CC71844ACE46584D6ED8849202B1029CFB472F43
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,EEDORb,EFQ78c,GkRiKb,IJGqxf,IZT63,IcVnM,JH2zc,JNoxi,JWUKXe,KUM7Z,L1AAkb,LCkxpb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,QIhFr,RMhBfe,RQJprf,RqjULd,SWD8cc,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,gychg,hKSk3e,hc6Ubd,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kjKdXe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pYCIec,pjICDe,pw70Gc,qfGEyb,rpbmN,s39S4,sJhETb,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xQtZb,xUdipf,yDVVkb,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=P6sQOc"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("P6sQOc");.var bab=!!(_.xf[3]&8);var dab=function(a){const b={};_.wa(a.va(),e=>{b[e]=!0});const c=a.O(),d=a.oa();return new cab(a.W(),_.jh(c,1)*1E3,a.H(),_.jh(d,1)*1E3,b)},eab=function(a){return Math.random()*Math.min(a.oa*Math.pow(a.ma,a.H),a.va)},PK=function(a,b){return a.H>=a.W?!1:b!=null?!!a.Aa[b]:!0},cab=class{constructor(a,b,c,d,e){this.W=a;this.oa=b;this.ma=c;this.va=d;this.Aa=e;this.H=0;this.O=eab(this)}};var fab=function(a,b,c,d){return c.then(e=>e,e=>{if(bab)if(e instanceof _.Xd){if(!e.status||!PK(d,e.status.H()))throw e;}else{if("function"==typeof _.cq&&e instanceof _.cq&&e.O!==103&&e.O!==7)throw e;}else if(!e.status||!PK(d,e.status.H()))throw e;return _.Sd(d.O).then(()=>{if(!PK(d))throw Error("Cc`"+d.W);++d.H;d.O=eab(d);b=_.gj(b,_.Via,d.H);return fab(a,b,a.fetch(b),d)})})};._.Dq(_.zLa,class extends _.Cq{static Ja(){return{service:{qO:_.$$a,metadata:_.aab,q0:_.Z$a}}}cons

                                                                                                                                                                                      Chrome Cache Entry: 338

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 1520 x 885, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):57497
                                                                                                                                                                                      Entropy (8bit):7.738115415295803
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:vJ6sZayz2pig7w5EZ9kq+Th3cBkcFjV5GQyIdRV8x4aW0l+EaJTjYmRRy:BVZP2pn7waHB+ThMyc1V8WRVY4eijYJ
                                                                                                                                                                                      MD5:D83873EEDD48CB4D873D454BD796AD06
                                                                                                                                                                                      SHA1:18A9A2BBF59D521BE18EF40A5393C2AAFC6D8CFE
                                                                                                                                                                                      SHA-256:2A623E93009C3FAB8821099DC04C11E35330B6B56D9B68A5788788644AF307F1
                                                                                                                                                                                      SHA-512:0DC14C652A923BA9F835F103C7DFC036E7E6999FE957F2EA78030F1C855BD26DD5869BF589974F3721C13FE2A0FF28C930A4024625285626B4373B325399368E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/activity/activity-update1.png
                                                                                                                                                                                      Preview:.PNG........IHDR.......u.....0..&....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^............<.>w...{.qc.?.c...3..xc.{......a..z.H!Y.j!..e<B.).H..-.0..$..j.$..6.%..@..A....$.i...*3..9./U....O.'$...dVv.|*;.................>............B.............@...........................`.!............. .|.........................0.................>............B.............@...........................`.!............. .|.........................0.................>............B.............@...........................`.!............. .|.........................0.................>............B...'./..g/....E.$.........@y..rE..(.....o/...p.so....5.e?.|.?....^.g.2............'..rY^................?.$..P..7^....)^..@...........>A.........t<U..../^...$...|....E.O|.!...|...............o\.V..t.e..".l..o6.]...g/.K.r.;.|.K&.]...o..j................on.....I5.e.W...........|.Kym.g.ug:..}W...9...y.o.#t.{d..x.ZxO..[g.m.x............0T..........e:....0.'.Iv.e.3~}.Dn.~.

                                                                                                                                                                                      Chrome Cache Entry: 339

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1453), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1453
                                                                                                                                                                                      Entropy (8bit):4.993372642434652
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:vkiuj0sZq3BRnZqTVsb7NujZ2Ru85CMq8GYBpicB1agUasptLQTU+9:vy0XBRuVsb7kSu85Hq8GY20ZTUu
                                                                                                                                                                                      MD5:9B7FC45D65CA31095C62174456E00082
                                                                                                                                                                                      SHA1:CF3FF1A786A6BCAA46EC3920AE84C509B6445ED4
                                                                                                                                                                                      SHA-256:7F32C7F57427B2FAD7825448B12DD6CDD8AB0EDCCD2960155C037EEC0B12FB78
                                                                                                                                                                                      SHA-512:C6C07039EBA800892BDFFCC54238B9AA71AC443A5EAB6355D4FDDF29409E65AF4BB2517DA25E506E09C764CBD72D9A5BACF0256471B53FDC5CC4F560598907E7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/css/common.min.css
                                                                                                                                                                                      Preview:::-webkit-input-placeholder{color:#949494;font-size:12px}::-webkit-scrollbar-thumb{background-color:#d7d7d7;height:50px;outline-offset:-2px;outline:2px solid #fff;-webkit-border-radius:4px;border:2px solid #fff}::-webkit-scrollbar-thumb:hover{background-color:#8c8c8c;height:50px;-webkit-border-radius:4px}::-webkit-scrollbar{width:8px;height:8px}::-webkit-scrollbar-track-piece{background-color:transparent;-webkit-border-radius:0}body,html{font-family:Arial,Microsoft Yahei,sans-serif;}ol,ul{list-style-type:none;padding:0}a{text-decoration:none}.container,.container-fluid{padding-left:0;padding-right:0}body,div,footer,h1,h2,h3,h4,header,li,p,section,span,ul{margin:0}.account-header{min-height:60px!important;background-color:#fff;padding-right:0!important}.account-header .title{font-size:24px;float:left;height:40px;line-height:40px;margin:10px 30px 0 30px;color:#42a5f5;font-weight:700}.account-header .title a{color:#42a5f5}.account-header .account-info{float:left;line-height:24px;font-size

                                                                                                                                                                                      Chrome Cache Entry: 340

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):4360
                                                                                                                                                                                      Entropy (8bit):7.917777321738175
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:sbeEU3WJLyibOnudbBdc4B1Zw2ESJK/82W:shkWJyibU2dHB159Qu
                                                                                                                                                                                      MD5:C1A049B4158DF0C0AE064169E059D127
                                                                                                                                                                                      SHA1:A185B72EFB20914F9164B2D3B82428E3CDEA4FEE
                                                                                                                                                                                      SHA-256:7F0A36C786B129BFC5A11AA1AD26F789BF88F68081B73706CE262626F80CDC2D
                                                                                                                                                                                      SHA-512:D8116CBEED979DAE222F6E0DC9BEDAAEE09B183D00B54FEF1CE8E6211C65FEA92C85ADC7498AF673E1AEEB956AFD405A7A5514DC59EE68EFAD9E6B6D8EBD3D27
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/mac.png
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD..............IDATx..Z{pT..G...,.......0.H.. ..,....HB..P.B-..>...%...)....v....N;.2.Z.....R...*$..$....=w..s..=.{6.o.7.....~.;./....:I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M..n!.Y.C..kD...@tMOO...C"~.z.z.{.9R".'.i3..?pvz....'..g.zx....6.".g...!a.....:..H.((.......?.Znv...-.1!"..B..n....5R.p.l.x.]D.....\.....?I....XP........].c.E.x...:..:.......2........'.1.5O.u.....SI..K*..M....~~]..*....s......k......wd?Q.Q.5.1..B?.z&%%..}.p..j.....k6.._.c....f{.k..s.....x..&...~.|.r.z.z.{.W@}..M..h.\..kM.....'\.5.B~..P.#%.DR@.fl.z(.W....*F7..........jZ>..N...)\.....7.....h:]@.Q.P.....`..k.3...i..,..n....y......!..[|t....#.._.....o..T.........n.:.<.c.......!..P@[}t..N.S.U...Y.].......`....-j7.W..M.}..._"....n.U........w...X........T..bh......l...,.H.o.....=.....^@?.....cA.x.\[..yc.Z....F.'\...K~...h....6........Q|.8...&.<...'9.3..[...sZ.k.i..f....g...C....._$...<n.`.,...i.;(...;..'..&.A..C@O]./rG...

                                                                                                                                                                                      Chrome Cache Entry: 341

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4336
                                                                                                                                                                                      Entropy (8bit):7.833212598431787
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:8YR2MOuraBXB1EcdV52FbF3N4yPOGWbgAli+hrnsumaL:NfjAHdLIbjWJNd
                                                                                                                                                                                      MD5:764DC7C4F9747AFC913F4B38C1EB9871
                                                                                                                                                                                      SHA1:805284BEB4603FD46040431BDFDDA42B636ABC7C
                                                                                                                                                                                      SHA-256:ED0FC7A2ADC70BFB82F669563216214B75D557EC63CDC750742252D35DB230EB
                                                                                                                                                                                      SHA-512:52707C502C46471D2302AAB5594D5CAB7D802AEF3EFEBF6FDD108F2434CB41BC35CA79398A5A101DDEC28125EC879F6366BADC2A59820934E4103B146DAF632A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:30D3167DA48411EAB05FA6B755E57B72" xmpMM:DocumentID="xmp.did:30D3167EA48411EAB05FA6B755E57B72"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30D3167BA48411EAB05FA6B755E57B72" stRef:documentID="xmp.did:30D3167CA48411EAB05FA6B755E57B72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>7/.....^IDATx..]y..U..^..fw...{.&....C..$.!d!!...HA,.....--.CK...E.D..B..@ .0...jD..rU)W.f!$;...;3....<..=...3...

                                                                                                                                                                                      Chrome Cache Entry: 342

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1272)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):50258
                                                                                                                                                                                      Entropy (8bit):4.801898811786963
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:MDi8OWdxhAgZahbAPlajmqRBBm+K+QvTJohAXul:MPtZlhXul
                                                                                                                                                                                      MD5:B81BDC4C72B132D8B69E76FF156648CB
                                                                                                                                                                                      SHA1:508897B09A6BD21D4BBD81C99BDFC04E044C4B2C
                                                                                                                                                                                      SHA-256:86498CD1FE367141AB1C87C6CAC96F86F7B5FD2CBA42E6A8EF3238CCAE1D6DFB
                                                                                                                                                                                      SHA-512:B7B8C7E60303DACCD40AFAE1560980F75ED912F85A9C29A8926EECBB83C99104B115A41AB1A3225F25EF39493E3069912168C7D4EF64E7BF2A4B86057CF28936
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/
                                                                                                                                                                                      Preview:<!doctype html>.<html lang="en">.<head>. <meta name="google-site-verification" content="XefMYB-gYzGdbpCtefadMMRl1EnW2UZZ7Y3r6x-UA7E" />. <meta charset="UTF-8">. <title>EPUB Viewer | EPUB Reader | Neat Reader</title>. <meta name="keywords" content="epubreader, epubviewer, Neat Reader,ePub,ePub reader,Computer ePub reader, android ePub, iOS ePub, Windows ePub, Mac ePub, Linux ePub, online ePub, online ePub reader, browser ePub, how to open epub"/>. <meta name="description" content="Neat Reader is an excellent ePub Reader designed for all your devices. You can read ePub files on smartphones or Desktop. ePub viewer available at your palms!"/>. <link rel="stylesheet" href="../express/vendor/swiper/css/swiper.min.css"/>. <link rel="stylesheet" href="../express/vendor/aos/aos.css"/>. <link rel="stylesheet" href="../express/vendor/bootstrap/css/app_1.min.css"/>. <link rel="stylesheet" href="../express/vendor/bootstrap/css/app_2.min.css"/>. <link rel="stylesheet" h

                                                                                                                                                                                      Chrome Cache Entry: 343

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (724)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):551834
                                                                                                                                                                                      Entropy (8bit):5.646059185430787
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:ytxIUYTteVvs0E8gSdoxS4MLYw1tZnAzsz1I9VBojCdzNDC2vPpD:ybYTZMgGopkAzsz1ciEU2d
                                                                                                                                                                                      MD5:33AFF52B82A1DF246136E75500D93220
                                                                                                                                                                                      SHA1:4675754451AF81F996EAB925923C31EF5115A9F4
                                                                                                                                                                                      SHA-256:B5E8EC5D4DCC080657DEB2D004F65D974BF4EC9E9AA5D621E10749182FFF8731
                                                                                                                                                                                      SHA-512:2E1BAAE95052737BDB3613A6165589643516A1F4811D19C2F037D426265AA5ADF3C70334C1106B1B0EEF779244389F0D7C8C52B4CD55FCE9BAB2E4FCB0642720
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.gstatic.com/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/recaptcha__en.js
                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var z=function(){return[function(v,p,K,u,W,n){if(!((v>>2&(n=[6,"Unknown format requested type for int64",9],n[0])||!U[22](11,this.U(),p)&&this.dispatchEvent("enter")&&this.isEnabled()&&R[23](n[2],this,2)&&R[3](n[0],2,!0,this),v-1)<20&&(v>>1&7)>=4&&(u=new vf,W=R[41](1,p,u,kV,K==p?K:P[8](37,K),5)),v<<1&11))throw Error(n[1]);return W},function(v,p,K,u,W){return((W=[17,7,46],v)<<2&W[1]||(p=function(n){return K.call(p.src,p.listener,n)},K=UJ,u=p),(v-1|12)<v&&(v-9|59)>=v)&&(u=M[W[2]](15,p)&&!M[W[2]](13,."iPod")&&!M[W[2]](W[0],K)),((v|8)&W[1])==1&&(u=p.Y?p.Y:p.I?"application/x-protobuffer":""),u},function(v,p,K,u,W){retu

                                                                                                                                                                                      Chrome Cache Entry: 344

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):200
                                                                                                                                                                                      Entropy (8bit):6.8089822048404605
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:wl/yi1ZrRl/Kiwi7/Q+x85mmZ4df7UVksyqUjLp/nwoZ9kqqVC03pjpolqeOo:wAi1Z6iP3q/4Uw7fDDkqq40Zjpolqs
                                                                                                                                                                                      MD5:DF61C422ECAE7409B8697262192A44FC
                                                                                                                                                                                      SHA1:D402D28A126D995638A2F434DDBD2B276887B599
                                                                                                                                                                                      SHA-256:329AD3C7AC436F964C7A8CFCC6A74C859B51CDABD8974A65F0836410B11F2DC5
                                                                                                                                                                                      SHA-512:32B50246FF38917D79C18C2750FDDDAFD991EBB72F9B1EADF0FF928FA0F083EE1C6BA74F697549E50743E89E1E9FB547E666A895801669C7AC65219691492562
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../.....@.m..a...6..}....$../..H..\.O.,.^.C|}lX.|l..<8Dl4<.\,.c....!.H..0..D.....8.D._..6.....4./.a..\.v......._...}.p.|..._.5......SLasI.R...<ODg..Qf...u.-......9..|.6.

                                                                                                                                                                                      Chrome Cache Entry: 345

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (9767)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):9878
                                                                                                                                                                                      Entropy (8bit):5.379210366392289
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:17AC3oipl7XNvFSTBv/CpvNE5qds7DKDTlxnnoT+eXhMKrqvwZpukR:17N3Z79gdqdsnK19oKahMkhZpukR
                                                                                                                                                                                      MD5:D067F0883540B1DDDA0E2C9AD1B14260
                                                                                                                                                                                      SHA1:9C3514916601F8EB3A45CD4A25F9FA040889D6BA
                                                                                                                                                                                      SHA-256:50A9333A7FF0D660714662CB1AB49EC81E1ED716EBA78C729600166F7338DA95
                                                                                                                                                                                      SHA-512:4B13B47307F18FF421817D52829994AF4536979DF4E1ECC656173400ED98C0E43F0BC3BAEF29F24E8ACC2868D5BF57C99CF4208DDC51CFAC7BD0C63DAF4B0AB5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/*! PhotoSwipe Default UI - 4.1.3 - 2019-01-08.* http://photoswipe.com.* Copyright (c) 2019 Dmitry Semenov; */.!function(a,b){"function"==typeof define&&define.amd?define(b):"object"==typeof exports?module.exports=b():a.PhotoSwipeUI_Default=b()}(this,function(){"use strict";var a=function(a,b){var c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v=this,w=!1,x=!0,y=!0,z={barsSize:{top:44,bottom:"auto"},closeElClasses:["item","caption","zoom-wrap","ui","top-bar"],timeToIdle:4e3,timeToIdleOutside:1e3,loadingIndicatorDelay:1e3,addCaptionHTMLFn:function(a,b){return a.title?(b.children[0].innerHTML=a.title,!0):(b.children[0].innerHTML="",!1)},closeEl:!0,captionEl:!0,fullscreenEl:!0,zoomEl:!0,shareEl:!0,counterEl:!0,arrowEl:!0,preloaderEl:!0,tapToClose:!1,tapToToggleControls:!0,clickToCloseNonZoomable:!0,shareButtons:[{id:"facebook",label:"Share on Facebook",url:"https://www.facebook.com/sharer/sharer.php?u={{url}}"},{id:"twitter",label:"Tweet",url:"https://twitter.com/intent/tweet?text={{text}}&url={{u

                                                                                                                                                                                      Chrome Cache Entry: 346

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3456)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):13702
                                                                                                                                                                                      Entropy (8bit):5.678110697688477
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:5a+/ULIVilv9Y3Y5g7SyyepPaHv+tqP0QVhJDrErY2+ko:5FsL6kv9D55eFaHv+tqP0u4rv+J
                                                                                                                                                                                      MD5:E2F3117FA522F9EA73131AD8D912F465
                                                                                                                                                                                      SHA1:6994C4ECC5E8C93946F043E06CB49C1EE02DDB72
                                                                                                                                                                                      SHA-256:FEA4C0E6393997BA2D0F0D91D52519E51BB0A3D8645BBE652788C4ED258D9176
                                                                                                                                                                                      SHA-512:928FD51560D1AE5EC1E2BFE44EF3FAC756A69099223F3853885B267EC417FAF387C0E08170CA16AE9DAAC9F5452E72DB714AA292B5656E8D490E4D6C461710A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".x1OGnc{align-items:center;background:#123a2b;border-radius:2px;color:#28feaf;display:flex;flex-flow:row nowrap;font-size:.5rem;height:16px;justify-content:center;margin-left:.5rem;text-transform:uppercase;width:30px}.ZYIb7d .VfPpkd-P5QLlc{min-width:720px}@media (max-height:360px){.ZYIb7d .VfPpkd-P5QLlc{max-height:100%}}@media (min-height:360px){.ZYIb7d .VfPpkd-P5QLlc{max-height:360px}}@media (-ms-high-contrast:active) and (min-height:360px),(-ms-high-contrast:none) and (min-height:360px){.ZYIb7d .VfPpkd-wzTsW{align-items:stretch;height:auto}}.ZYIb7d .VfPpkd-cnG4Wd{padding:0 0 0 0}.IsssNc{position:relative}.AcxtQe,.TRaZhc{color:#8d8d8d;cursor:pointer;position:absolute;right:8px;top:8px}.YG3b9e,.adTxc{background-color:#2a2b2e;font-family:\"Google Sans\",Helvetica,Arial,sans-serif;padding:40px}.YG3b9e:not(:disabled),.adTxc:not(:disabled){background-color:#2a2b2e}.inFyWc{align-items:center;display:flex}.jmkV3e{color:white;display:flex;margin-top:10px}.KCiMwd{mi

                                                                                                                                                                                      Chrome Cache Entry: 347

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1196)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7496
                                                                                                                                                                                      Entropy (8bit):5.470932318854405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:qQHF1mUAyTf7OuMJwY2LxVLpyx0y6y+yzySydyQajl3cdhOM5zyzPdiu4F:qAlvTyr2l3LptPnoXC7apcnNzmc5F
                                                                                                                                                                                      MD5:45C20EBE56AC361A05D579CFE0153874
                                                                                                                                                                                      SHA1:DD55ED7E8F25020AAA9828C56F9630139A5B16B0
                                                                                                                                                                                      SHA-256:460AD1280B072B74D65FBF28B3D1564DE979F116F799FECF70EA5D267A51239C
                                                                                                                                                                                      SHA-512:C0B753FD72E20754C353892F5520C21260FF423A53EC5193798AEE7727CCEA62C3006961209A537838CEB930FE18593B6D642EB4B629433A3A031B4F6B8EDDDE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.zMa=_.B("VNcg1e",[_.ek]);._.u("VNcg1e");._.xFb=class extends _.Cq{static Ja(){return{lb:{soy:_.Ws}}}constructor(a){super(a.ua);this.H=null;this.ud=a.lb.soy}};_.Dq(_.zMa,_.xFb);._.w();._.AMa=_.B("JWUKXe",[_.zMa]);._.rf(_.Dj);./*.. Copyright 2018 Google Inc... Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXP

                                                                                                                                                                                      Chrome Cache Entry: 348

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2722
                                                                                                                                                                                      Entropy (8bit):7.8727726962438425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ByTJzer8qxuEKO+Wo1V0u/ziv712frevONVHVOyrQlJLZSiSaJqs:BqY8CLKOfo1V0u/zi4fyv0ZVOQQ3Z0a3
                                                                                                                                                                                      MD5:F05DD12540DC41F4295B4268AB93049A
                                                                                                                                                                                      SHA1:B25FE803B71C98ECF0766C2BAB88DDF4935231C6
                                                                                                                                                                                      SHA-256:3315CBBBB8A58D16B91DD5437707FF4D0AE387CCD2F36F3004327233A273BAE4
                                                                                                                                                                                      SHA-512:6FFB038A13DDE599023C675F7FEF1D8EA2D0A53A96BC6CA3F9B7FD9D7246E3D63DC00529D6738569628A4ADC3F68FEF5C30067476AFE0305C898EDC7DBC3669A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............ALPH.......m.!I..D.g6.l.m.m{......^{.ms..Fd.\+2....`...8.B#WR#..1@0p......@..V....m3......9.g.....z...........O8....'......G...=<..w<5..@.....s.'..VA.v....?..........o..A@.....G.......9...V..]_........ .3m.i...:....+-id..,.......Bi.I;..............?.......\i.+..V.GA........S8...W.gO..I.w......m..q...>.9......'.cU...gAd.1..C.u......D.&dD......\E}...<.Y.1.."6.|...r.8G.<.R.z......?;.y.5 ........`3d..;aB......2.;....e...@.8;.......`..hHBP.1..SjCa..[..! .......CL......H.....A1.Y6epB."c.e. 2N2."....$81"p^......$..@lmV.A.&.$hV....&.3.#...&.:......5A.Av..d..!60. ....L....D....f:......D .7..q.#$0)b.....3.h,..2......|3$IN...f.?~mZ..0.'E....r.)].Kf.....+0...w&.......:...q*d`....G0..............'....._........_.eO.,.........g.........."3.....^.z....Q"c...z....z.........`r.g\.}..s?......oc......{3......8..0880.$..M.M.._..0..._?.K.uP.@f......}$..%0 .b.&...`....A.M@...s... #.M41.......D.MB..q4v.....@.dC..D.....@..0....A...&.&...

                                                                                                                                                                                      Chrome Cache Entry: 349

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):34940
                                                                                                                                                                                      Entropy (8bit):7.994451784363584
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:N7MwsSC+EZ15Hl/2nia9Hv41MOe3YMXEw2RTkAlkZMuNyjT:N7bsFHZ1D2X9P42CMXEwqTkmE3yP
                                                                                                                                                                                      MD5:DE5E627A8A024570E8659D48032C77D0
                                                                                                                                                                                      SHA1:62A502B8F70D42BE27F9CCF5AFDD686E17C8801E
                                                                                                                                                                                      SHA-256:2D32088635E533B4EA238BD1020A4E131CA7299947EAF996B135BC892999A308
                                                                                                                                                                                      SHA-512:B97FCB7C9E6C0BA2F7D3639262642921A359440D2C8A0AC73760D11B88FC4737793530162DF64C518BBB6A16DC2D485DE6263980B73AE0B2DF1F42B5824D2E3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/8OaYiZQ_jORGwIg21BnwAQJD8cA4K3C-PPgFgsvdXVFbuxTCpb2qg64qWVmHGKv1JZ0=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFt...WEBPVP8 h...0....*..(.>a(.E.".....@...4...........|.qP..}ih)..~.y..|.x.............?..l]3..._.....>..].....r...w...o.?.?q.....{..../.......].......~.zt.....a...W.O.s........l...../.........7........q~.....W.g.........O..(...k.#...?..;.+.C..../.w.?...........\?u.g........,..o..........?.'...._......U...?._.~....z...[..........._.O....V~^.@......(`.....G.uM59..gC.X......:.Ng;..f..kD.u...<..DU<.3.q-.9.+....nL.US....b.7}s..m....7...=S.8.y..3...[..1...JI.fB.W...S..].Q...D..Q*..l.a..Q......z~.q.M......G..O.....I...h-,?P~&?/..E%{\...m f..C..'.-....%....+.h......KKe:.6...#>Mz..0.u.x".-..o...t%9...4.&..p.1..Ga..P..]TQq...........}M...vu.....rOs.?.V;...M.,.Z.."e...5.p-....$......,v.O+....n.# ...[>.~....@..g.|K....h..m..h..k....v.g:]%{1XY..........:..d..qM.r8:....1,....y......V....ME4..ti.....0.&....aUP.e.....~W...r.m..iq.P.%9..z..|,r.....Oq..W...9.....!.V.....N.a6.j...f?.......:..Q.u......4..G+.X...k|.............}..]...UR.8..@2_..!Iv.E..y..s.}....u..

                                                                                                                                                                                      Chrome Cache Entry: 350

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3320
                                                                                                                                                                                      Entropy (8bit):7.814761165838013
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:bCyYFFhat3c8/SkfmBf9SErgi3NHY1yaaXCgjFw1rz:RYFFANcSSkfmBMErt4aywC
                                                                                                                                                                                      MD5:A1B22D82FD016445A776F6B20E14F11B
                                                                                                                                                                                      SHA1:D91EEEE7C20FD5F815761FA845FBE602A4969029
                                                                                                                                                                                      SHA-256:6A1EFD2A5CF4E8846F8B6E5DAA0D14640A70AEC665CF0A7AA549B1BCA55E7D81
                                                                                                                                                                                      SHA-512:7836B98E0D81CCCD42BDAE114ADE830CE717BC4741355CC53E75069B9C64CDF1764EE6E3EF0BAEFAB3BF1477B721085075A61F42CCE1F97632F2341030BD3E47
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD..............IDATx...ypU...p.(....?j.)3..3./... `..B..... `e....P[E.L.Ge.#...Zp..$BHH.!..e.[. ..ID...&..~......w..m.7..%a....s..C..E..-Z.h.E..-Z.h....hh!...2><<....-xn.......M0.....U.3AB.3~.9a..q...Ihd...A..|.|..M..!."o..9.....`..1..<.b{~................s......ADK".~..x..). .C..).............31bn."v.CJ.C..@|B..9.....i..........*....,.^x!*W...;w....?$|........m..Q......x&.H" ^.'GD..Q..I.......y..U.e.6...{....Y.@...Y.gB.$..cXD......,.......y.(<|^A...g@...z..Y.=N.0..&ALr....tK.UJL..8.. d@1.Y.xh.$..B...h:J.$ZR. '`.O...[%..u....$^...R... .B.I0.B./ n.....P.'; .X..Y.R..1.........6..... sp!yV..C*B..o<J...%.........(.%".R....V...R...D._....2...QD!...)...w....."@..*.B.....G.H.@.x....R.F....B..j.....$#6..H..Ol......). .i.. y.h.!. ...)w.I.MiH...P..".HI~9.. ..U8...W...G.!. d@i.N..".!y2.u.4........tF.$....F..H... %.Y.9..y..7..7....P.(".H.^B..F..!.J..U:.T.t.........?OlfH....Y1H...@2bCr.h. ..I..W...F[.$wb#@.2..t.'..

                                                                                                                                                                                      Chrome Cache Entry: 351

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1753
                                                                                                                                                                                      Entropy (8bit):7.846356876733626
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:GgEjXa2Ca37qkInSnd6nMqiLiciiMPPMP:2za2D37q7Snd6niLjRM3k
                                                                                                                                                                                      MD5:2C60D6A8E796264F0250A21EEB5C0A97
                                                                                                                                                                                      SHA1:651B1798DD2EE1A8BC3B790F1BB0F57B682AF212
                                                                                                                                                                                      SHA-256:2872AAC827AC1B09363A0F4DECE363E5BA49773B0136D0F62122BD2313372C09
                                                                                                                                                                                      SHA-512:DDFF50C9E1039351DECFF5A9C87D2A12A6CFA4CF323C6AD7B0A058A92191FB876EE611788D73FEF797CA1FD86C857BAD5ADE6FE15223C038CFC5BE50AABB3662
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/cloud.png
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....bKGD..............IDATx..[ilTU..D.......D.K........(BA...AT4Q.b\....U@..`YZV... !JA)-TJ!`.J.e.2...y.>.y.J..y.y..Y^....}..s.=.......V..iE.a)!.........&B..&..|B.}o....M.....v...B.L@...6.H.vb|T...pO....._2@X.E.GC.....7.@U+..&...D}.+o...#..6...t3..........^.X=.#..S.$..9u-.n.yrH.P..QD..v....4.>.IF....Z1.O.".N^...|'v..w.#o..."..G......g...Nd...11.5Pe.....V.u.7Ep`.-..5.~../.0..4L.... G..bnz..yqH^...knl...*........._.1y..P.%.~..--..yU..2 ...].L..V...v.v....j2...W....``qp<Ab....%..d...;.$..T.p...=.%.(.QFryh..`...hNf.w.O`.g.|Xp....;.w.....&....^]". ..ZL.....u.K......'.x00..x ...B.y....U.."....6X.$cJ.[..nHwb.))..#....w..o.....A...v....w.!1?.%.4..@&.........n..|.2.7.k....8...~.7..NK....%.L..uN..h`.wN.8....hq.z\.v#..zM'../..a.#H.....42c..R..3....# ...K.5#....\....^..ai.r.b...2.#.`..Og.1..WX....%b.4...#....o..w...mx;W.7.....+2^=...)B\._..j.....6k.`2....|.Y&.n....y0r.....9..RY.|y...9^]B..$.....H=...-.....&.i. ....Ons!.o.".....

                                                                                                                                                                                      Chrome Cache Entry: 352

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (724)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):551834
                                                                                                                                                                                      Entropy (8bit):5.646059185430787
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:ytxIUYTteVvs0E8gSdoxS4MLYw1tZnAzsz1I9VBojCdzNDC2vPpD:ybYTZMgGopkAzsz1ciEU2d
                                                                                                                                                                                      MD5:33AFF52B82A1DF246136E75500D93220
                                                                                                                                                                                      SHA1:4675754451AF81F996EAB925923C31EF5115A9F4
                                                                                                                                                                                      SHA-256:B5E8EC5D4DCC080657DEB2D004F65D974BF4EC9E9AA5D621E10749182FFF8731
                                                                                                                                                                                      SHA-512:2E1BAAE95052737BDB3613A6165589643516A1F4811D19C2F037D426265AA5ADF3C70334C1106B1B0EEF779244389F0D7C8C52B4CD55FCE9BAB2E4FCB0642720
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var z=function(){return[function(v,p,K,u,W,n){if(!((v>>2&(n=[6,"Unknown format requested type for int64",9],n[0])||!U[22](11,this.U(),p)&&this.dispatchEvent("enter")&&this.isEnabled()&&R[23](n[2],this,2)&&R[3](n[0],2,!0,this),v-1)<20&&(v>>1&7)>=4&&(u=new vf,W=R[41](1,p,u,kV,K==p?K:P[8](37,K),5)),v<<1&11))throw Error(n[1]);return W},function(v,p,K,u,W){return((W=[17,7,46],v)<<2&W[1]||(p=function(n){return K.call(p.src,p.listener,n)},K=UJ,u=p),(v-1|12)<v&&(v-9|59)>=v)&&(u=M[W[2]](15,p)&&!M[W[2]](13,."iPod")&&!M[W[2]](W[0],K)),((v|8)&W[1])==1&&(u=p.Y?p.Y:p.I?"application/x-protobuffer":""),u},function(v,p,K,u,W){retu

                                                                                                                                                                                      Chrome Cache Entry: 353

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42322
                                                                                                                                                                                      Entropy (8bit):7.99596563855182
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:eVTTtywwXjTdLjwT35hjsan6BzmcfM6DDyLRB3Qu8zgy1vXUGFcndCKLev4:eVHvwtLUhQa6Bz/MSDeRBQuigydpuB44
                                                                                                                                                                                      MD5:28072429C2565CD8226F3FE62774AA3A
                                                                                                                                                                                      SHA1:AC550713A85133748B331306EF7FF084826B4CBD
                                                                                                                                                                                      SHA-256:410CF2E9600AE8EC37701944F7ECCD2EA54E82D91FF19559F4E8823C1E344958
                                                                                                                                                                                      SHA-512:39B59CF822578E57AAA6F3888B425D385BDA24D8511A4CE89CA26274B497619880A1C2C8DBE6C21F2C531AC15A2A2B5D82C2938ED98BCDBEAEC1D07006A5DBFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFJ...WEBPVP8 >........*..(.>m*.E."..07.@..fm-*.q.[....?.b.......HnM...ZM.w........y....c..._.oa..?..S.......c............~.?.......Q.9.#....g..^.......?w=..........{....(._...o.|......._/.....g..........?..S...... .S...c.......^....S....../._..~..........=\.5.W...........~.>....k.O....._........W..........n...O..._._.......e.....'...../........#)'.u{u...4$.e0d...I4..);^...R..i.@..4...(...GH......N...k...=..w.]WJ./. ..|.G..0..f..........U....P6~.h=....#...|+...}...T.67.Vsn.F.....a...c.k.l.......t..:.(...zx...0.'..,-....;..V^..a".Q..."xZ..`.(6......V..s..........f.fe..djb..*..{#Im......x.)....V<!U~..YG...&c...G.W.g......z..C...x....T..i.......N..Mt...o.iL...;3J}H.n.WY9%.C....q..u....T..!....!...v.3.*._...4....s}.tV.7./...jx.S[..RLH..l..V.4>..../G....t...6.TO..F2..c....I.....Vo....._..k}....&.l..xs..@0..Jw...e.h....mN:.....T?..T...+...L'.>.4..=..kOc....9......H.8..."J?*E..@..5p..[.2oG....z.....F.i.o..........k.W.ub.......Z.7.>..5.e....A.*.*P\.

                                                                                                                                                                                      Chrome Cache Entry: 354

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (13425)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):13677
                                                                                                                                                                                      Entropy (8bit):5.279145225606813
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:tXUbeQS7Rgx9BU0m/XCcif65W/1mXA82FHpx:tEb67gbhm/XDif65W/1mXA82Fn
                                                                                                                                                                                      MD5:24F21657C5465ED6E144FB4401350E07
                                                                                                                                                                                      SHA1:1A7B8F26E33FEABC257ECC8E954CC3F0E1F7AC60
                                                                                                                                                                                      SHA-256:906BA97C9E3365BE3F9B418F3D56349E0EC5C128D99B5134C0C586D5A4586F09
                                                                                                                                                                                      SHA-512:B824260286B1E9A253C42D375651F4B8212D13488B8BCDD35B5421E957B3119E58D7BAD3AC813EF22AF3E07E1E84CEC56DF6E6F2B6F7D0E931564BB0857C6B46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/swiper/css/swiper.min.css
                                                                                                                                                                                      Preview:/**. * Swiper 5.4.5. * Most modern mobile touch slider and framework with hardware accelerated transitions. * http://swiperjs.com. *. * Copyright 2014-2020 Vladimir Kharlampidi. *. * Released under the MIT License. *. * Released on: June 16, 2020. */..@font-face{font-family:swiper-icons;src:url("data:application/font-woff;charset=utf-8;base64, d09GRgABAAAAAAZgABAAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAAGRAAAABoAAAAci6qHkUdERUYAAAWgAAAAIwAAACQAYABXR1BPUwAABhQAAAAuAAAANuAY7+xHU1VCAAAFxAAAAFAAAABm2fPczU9TLzIAAAHcAAAASgAAAGBP9V5RY21hcAAAAkQAAACIAAABYt6F0cBjdnQgAAACzAAAAAQAAAAEABEBRGdhc3AAAAWYAAAACAAAAAj//wADZ2x5ZgAAAywAAADMAAAD2MHtryVoZWFkAAABbAAAADAAAAA2E2+eoWhoZWEAAAGcAAAAHwAAACQC9gDzaG10eAAAAigAAAAZAAAArgJkABFsb2NhAAAC0AAAAFoAAABaFQAUGG1heHAAAAG8AAAAHwAAACAAcABAbmFtZQAAA/gAAAE5AAACXvFdBwlwb3N0AAAFNAAAAGIAAACE5s74hXjaY2BkYGAAYpf5Hu/j+W2+MnAzMYDAzaX6QjD6/4//Bxj5GA8AuRwMYGkAPywL13jaY2BkYGA88P8Agx4j+/8fQDYfA1AEBWgDAIB2BOoAeNpjYGRgYNBh4GdgYgABEMnIABJzYNADCQAACWgAsQB42mNgYfzCOIGBlYGB0Y

                                                                                                                                                                                      Chrome Cache Entry: 355

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7510
                                                                                                                                                                                      Entropy (8bit):7.953539678433074
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:7rPcwFQ+XWwNzt021tuM572WjKH6GLkF91hhYPVrCIYIAG7u9vtTTpc:n5u+Xhzt021tLl2DdIF91fsCPIaxtfi
                                                                                                                                                                                      MD5:7B14CC70044D22ED1DBE4CEA4CF7E556
                                                                                                                                                                                      SHA1:6AE8ECEDCF330CEF36A966F940D4B428642FDD07
                                                                                                                                                                                      SHA-256:4FB627F8370C1DD127E22986AB3779DE7FADB0CDA4D8A1DC69C4801896D8E638
                                                                                                                                                                                      SHA-512:50CDD75BECA37860D909752A7511D0309468B492DC0AEE741E434243DD8083640ACE37934B0AE6627F1544C1D7207E29C06D5C25EFB376995412C203F6D8BBE4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFN...WEBPVP8X........?..?..VP8L..../?...M(l..Vv.Z....G....|.5O.n.Q..`..#....h...$Ee.>....m.8.H..dBbB.."bw..?..$E.A.Q2....?.........x.A..pF......A...7>.G..Nl.*.xn|qd..H.}.k...{....O...._.#E@..../.......1..m#..ao.@.....p".$..(...V.\{.+......I..(.....A."^...k.5...m....u.%.E....M..rFe~..om.m..Si.A........QZ.G.....3.....cf.9A..I...m.(..>_.m.m...~.m.XT.t..4...<^.#N=...m[....I&.k.fff...a.y...X...B.....0Q..$7....U.m..mk[.6...4.....m..p.....un.mky..1fWk..P...S........f........R..{ZqT^.1....C..]KY..yc.....$.".CR......S+.k....#..(/H.k?....Z.....@..|%T.IpS-.kg]).`..u..............m...%....t.+....g-9...d..4.-.......v..Nw,..o.`...O&.qH}.....U...UW.W;.h...."Y../.MD!A(...`..G{..z......^.E...8.+/].!4.u.!.s......i....Vy.o..cYKwQ.fQ(.S..b.8SH..S`D..d.+..k.....'...i..J........W....xN..C).L...........d..[B..!.!....aGV.m.=..?..Y......P......k.....xH.+...-..JXN...z.../....p.P....K..n.0..j....,{....c.+:.E..H...T.....e....i.............=.!P..b..X4.P..F.../

                                                                                                                                                                                      Chrome Cache Entry: 356

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):67646
                                                                                                                                                                                      Entropy (8bit):4.558297338561872
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:kQy9Ep0a8vb06yZOWPGlJOZHu8UTrAfW8Et16tBtLe087UgbJKUET2O4t79Si5nY:7y9cgEe4iY
                                                                                                                                                                                      MD5:051CE92715B8E1FD2C4DD03AF564CA7F
                                                                                                                                                                                      SHA1:36BAF424A7FA3754CCEAD05557F835772316BD68
                                                                                                                                                                                      SHA-256:F7C4A8AE0521C202AB8183917ACF5E425450F56C53354F6F1117B1288FE22F38
                                                                                                                                                                                      SHA-512:A501806B88C02950F6AD81CC3B9E44A754D77B890EA7AD0EAC9CB1D7655BE7512B758C94D05407DBDBDE7A318CA5DEDF974B34304E36F3AD8F34FDC21024A8D1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/favicon.ico
                                                                                                                                                                                      Preview:............ .(.......(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      Chrome Cache Entry: 357

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):695
                                                                                                                                                                                      Entropy (8bit):5.125487126436221
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:YGKhFsiGM1KxMh4zjv8phy8sBhy+oJWZ8t5Eh4KWZ5+oJWqs44CP72EtZ44XuPSb:YdhnGM1K2izjv8qDCsZ8tWiKi5sqEC97
                                                                                                                                                                                      MD5:5AEE85576DAD928921F179713A5FACC7
                                                                                                                                                                                      SHA1:D2A0A4B93F0EF58FDEEB569917603C68183D2686
                                                                                                                                                                                      SHA-256:7E0781E4C2251D021988B95640DD00108B002C01DD607850AD21C5E72B50AABB
                                                                                                                                                                                      SHA-512:7075BD5127AAA3F688D012C2546DA42A9D7D5835D11605051F0802D04385BE48012B3DAE29E9981CCD13C208E14593E2AB9D627351948D2D4A4B324C9DA39435
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/app/api_v2/getSuitableActivityInfoByUser
                                                                                                                                                                                      Preview:{"code":1,"msg":"There are currently activities","activityType":2,"activityData":{"code":"JTMRW","param":30,"createTime":"2024-09-27T00:01:00.000Z","expireTime":"2024-09-29T00:00:00.000Z","activityId":954,"activityExpireTime":"2024-09-29T00:00:00.000Z","activityUnixExpireTime":"1727568000000","activityGuid":"83f4c120-7dc1-4372-b266-ca17c2470b3f"},"activityData2":{"expireTime":"5 hours 55 mins","activityUnixExpireTime":"1727568000000","activityInfo":"Limited Time Offer | Get 30% off for Premium. Ends 9/28, 11:59 p.m. GMT. Learn More >>","activityMobileInfo":"Limited Time Offer | Get 30 % off for Premium.","activityGuid":"83f4c120-7dc1-4372-b266-ca17c2470b3f","code":"JTMRW","param":30}}

                                                                                                                                                                                      Chrome Cache Entry: 358

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):7094
                                                                                                                                                                                      Entropy (8bit):7.959419718247538
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:F3JYFJ9r/nyXq20/1FmCXl4CbMM1kJ2ednlhhuFM:sB+q20/FXl4LM1kjDOM
                                                                                                                                                                                      MD5:28C793A8D42E2BF761FF6BE55C664010
                                                                                                                                                                                      SHA1:70D072E2744B5A30A99FE99AD0AB4ABA2CCDC124
                                                                                                                                                                                      SHA-256:633014DDBE1C4043A35FA963EC4EF649032F924B61BC717DE33C233C19534DF9
                                                                                                                                                                                      SHA-512:32C7123534B0F5F27ACF79A4C16A0A8617DE9AA790B90ED770167A2724A28024855792D949E5D90FEDCDD460DC6DBAADE1C9C4685EE7DDF41F60C64E23301CF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/Y9BUoMIWfhZDUFZ_MxQmnsgSyb3O8s8Sds65E_j46-vdDSJi_0Xqmoa-fHaQa7fGlw=s64-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../?...M(l..Avw.......}.w...)..E..... Y8.$I.......g.c.l#.n.x""E*.*....nXG.m..g.W!...x....._.>uZ.......-j..1.....o.A.(h..q......3.........;j...v{.9.."..xL7.....o.v.U...G...IK .80M.5.L..`..i..e.....@fwP..QK..z.=.......d;.M...T......h.h.h.(23$gF......... y..m...~...R..m%.......!+.##.Q;j.....7.l..as^.......4C.9..N.......kx..9..U.I.....m.e..gx............L.g.|.m.m.^.l.m....5......Q..6C.m..#"U.}..y.m.Z.m.m.6N..>.8.....[..$.y..DU6...m..mv..m.k......../.....|....... .@.h.py..........|....a.G{..h.e..B@}d.I....G'...K3.....l.".bi{?.0....h.H..!....$..T.B..{:..Q..x.........&..P....V...|.H(BZ!.....?EQ0 .....c9....> .Q..@.....%5...!.j..YB..-p..$..>.KE.f..Xk"IU0....P....KG......7.W.4T.......9..s.@.=.j.!.......(.....>.....=m>...V5...V..[@.z. D...b....Y.....t...m....3W......b)C'2.......i..e..~....J2.0*..F.....>.....i./.}....U...O*.S.gs.<..+O..k/....x...~..]..-].......~.qx.KT*.].I.@....<\.&....sK7.".D...h/....h-..om

                                                                                                                                                                                      Chrome Cache Entry: 359

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):16157
                                                                                                                                                                                      Entropy (8bit):7.932926875832688
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:r5upNQivITZNsbPTJ949bKll0Dl2cRhShvYKkkrMidnDI/guG/8bEwqcUM3GlLhx:rY3vWcTz49bOluShHtrUSw3x3G/x
                                                                                                                                                                                      MD5:044092FBA99A51DA431A8A79888A316A
                                                                                                                                                                                      SHA1:4D83A9B18A7FDC12B932638A215575721A2F6187
                                                                                                                                                                                      SHA-256:652844DA329612F397FD4753D6C41D8048D3B8A32D9A7A3125EC1D3CC42B274D
                                                                                                                                                                                      SHA-512:EB4BAA2635C51D912927003F746DACE42B5E5364B11F8C0E5CE724E8BF1736DD05F393479EC97CD919431CDEC10EF917F6AC28F23EB2B090C409224D4D0998B2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/PqMlpEa_N0A/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF............................."%% "".(%% %.'10-'--5=PB58K9--EaEKSV[][2AemdXlPY[W......./..0W=5=WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................H........................!1.AQaq.."2....BR.....S.....#Cbr..3......s...$..............................*......................!.1AQ.."2aq..B................?............................................................................................................................................................................................n.7y(.F..T...k.]V:...n..O.......^.U5MV"...R.......R..........}...^...4z.j>..y..*j.y./L=..}..y..*......=....O........?.R....,...E.<....^.>...?.]........Dy./Z....3.g...(..........O(....W6...............<....\.~....G......}..". ..?W.................{....l...E....l...D.A...<...Y....#.?............].>....\?...l...Ev.y$/T.@-c...y..*S.....P....^i....Z}.>.U...O.G.w.........}.>.U/.W.Q...k.!zo.{W.P....B-_iG.....!z.z!h..

                                                                                                                                                                                      Chrome Cache Entry: 360

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):27764
                                                                                                                                                                                      Entropy (8bit):7.992358323769748
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:gUQRW/ew0SXJlFnDuF2W5EddDde5gwPyp365YDIoX3nvG:gUQRm1ZTDp5DQgwPyp365YD9PG
                                                                                                                                                                                      MD5:4FC69F89F72C19287229FFE2728DA8A8
                                                                                                                                                                                      SHA1:DE9A27EBB7686DB903040347D503DDCA5BC7AE84
                                                                                                                                                                                      SHA-256:7B877924FBF08113E75D32AB3B765DCC0A00DF412072E4B90CB0181CAB2D4A0A
                                                                                                                                                                                      SHA-512:8908D7AD607ABDEC8C1CFB95E9E6F13BEAEF9945D3DD627428B731ADBDEC5B8FD124C798B13AACFAD798F1F42C0150FAAE6281626FCC9408B18D906E8179858E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFll..WEBPVP8 `l......*.. .>.D.J..."$S.(...gn........O/.....mB.{..=.s...g........t._..*Nm..+...`^s.............e.U../..`..oY..........._.?..`j.y3._./...............=.....'.oh...V.o........{.........W.....x....... ...,.%...o....Mk....P_`...S......s.f.E.3..._.?..q.1.......G......&>N.Q.o.......e.....a.....7....?.?..........o._..|..4...o.?.o}....~.~.......}....a.qt.s..I.Y..5.&.B.y..5B.E+.h....)^kDMP..J.Z"j.,.W...T!dR....."..D?|.....Xn.VV.PB.\d....H.M..l"e?....y...#....E..(.mB.y...T.2.".............(J.f.w....?.v..."..".6}.E.Jy.T.M...C.ZU..9..9.-....CzvX..O.h-..0...?.PQub...J.g&.....w.2..1.."..e.W.....Z"j.,.p.f...."..D....{.v8.....o.{.5.)-.|..d.#..]....g.ET..L.7......5.....^.=......9.o.. 7t..d..t....V....V..2...c.).76.j{.Flv...(..gtH....e.3....5*9...>..9.ZM\...I..P.)^kDMP..J.Z"j.,.W..&.dR....."..D.........].*....J....../P..&'.P....T6n}/.MBW..- ...R..S..#k.R......K...... $...@..#Y../Bjm.B0$.Z.....*5.("v.....<............uB T

                                                                                                                                                                                      Chrome Cache Entry: 361

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1872
                                                                                                                                                                                      Entropy (8bit):7.774667148268881
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:++wyPdsTp50W9dEnnX+LX8oa8eoNbAWxj:+y1svOnX+L0loqWd
                                                                                                                                                                                      MD5:4BE5982BBB6815A8C5727375A9F91D9C
                                                                                                                                                                                      SHA1:41C292C69B090BB788599AAD18DC132B057E62DE
                                                                                                                                                                                      SHA-256:F7A3C9CB75D1AD1110755565E9C1C2C8F31C736FB45FD95F54BE15C0E6922B6F
                                                                                                                                                                                      SHA-512:51AAD96F1790FFE4C803840CD1D2B29BCE1B27542163B76831E83B7E77BF0F2225286926E5D148C3B327E1B332E77A5AACE21CF94FD4B9844844B822D8173B2F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/SlNWW77MnTXiLLOUVsjx25bOocB8vNO5BRsh9YN_K7w3ENN8RACwXW1KEJ7pnS27XOMp=s64-rw
                                                                                                                                                                                      Preview:RIFFH...WEBPVP8L<.../?...M(l...n..........m.ZD.... ..l".vr.'gJ.+z....L....$.i~..$......T..c..........B..""+.r..;D6.A..J....c.....he..1...z..[.nED......A.tl.v$)...l.h.S..0.L....A.......Sk..2U.]......_nm...}............P.6.J..'b.....9.m.m..T.X.+.....L..6.....$.f...!o.S....>.....'.@. .K..J...&...PP...k...E..I...D..-..Y.......=......d@cg...j.,. ..w.];z.).[.K`.`.n|........}.....i+..6..C0.-.0..y.....z....N.9..$Ku.0P.v..xU........z.-...x.....j..D.3.h..D...$L..._^w}.J..-7.7...@...Z=.@.`...j... ...k.&.............T.[..j.@..t[.......u. .g.&...lz..=.|..._Q.5M..... ...0$g.?... L...v.{.Q.^7...!..8lJ&.a..J...V...@...I!..P.P8Y.3........-W...>]......}<......v.:?...0t.!.-....A..$....z.w.l..~.k...=..b...jme..G.?.c....u.B..u...;y. sh......w+-........Ub.X.X`(..8..... `..j..N.#......C.-.+....X.Z$...D....^!.'.......G..6..:.R]S....@..a...&.b..5q.'..H.....S1P...j*i.t..............C.. ..t.....D......2+..,.A4.d.......r. ...WA.2Q...@b..Y.:.M.UHZ.%e.f5 i.u...W$)f.A*.t..;...b...

                                                                                                                                                                                      Chrome Cache Entry: 362

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (5945)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):265811
                                                                                                                                                                                      Entropy (8bit):5.572939986047107
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:KjJpmFU7Dli04d7G3BsEemvevNnH0fxnQK:YyW7D4nhiZ7
                                                                                                                                                                                      MD5:9B83A29E456385A24CECF15FE5722A08
                                                                                                                                                                                      SHA1:C2C48A7645B303697A81D6198CDC71D0D048876C
                                                                                                                                                                                      SHA-256:8F01EA8F9A248AFF0FCE64788F487750688A9697E247F855B91C040D71AD2906
                                                                                                                                                                                      SHA-512:6AC95482FD2DFB0953DC385791248D0117A01E3D00A15C6A77638B1D2F7659E92BDA9E481F850EA8597FDC374C0FD311F7CE780582981AAD221C2E2E8B659567
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.googletagmanager.com/gtag/js?id=G-6VGGZHMLM2&l=dataLayer&cx=c
                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"6",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":16,"vtp_rules":["list","play\\.google\\.com"],"tag_id":10},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","play\\.google\\.com"],"tag_id":12},{"function":"__ogt_dma","priority":6,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":13},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":

                                                                                                                                                                                      Chrome Cache Entry: 363

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2384
                                                                                                                                                                                      Entropy (8bit):7.880658109187703
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Jp6H3I0OrX7lZUZ3B2E5/biWjWMO46Juzt3w+EE68jNFJkGKLs0N5:JwH4LXRZeLl/nlhEMdKr5
                                                                                                                                                                                      MD5:0DB283C140AF9F4D5EA510AFCA8BD788
                                                                                                                                                                                      SHA1:527E38AB7AD2D058C71357591EF770490748FFBB
                                                                                                                                                                                      SHA-256:93DA6A2392F4627DF5597D9568B72718D7474F35FCD6DF6D1C1799551DF3AA7D
                                                                                                                                                                                      SHA-512:48622B3856CDD202B7B8D444F915FA8DD2186C0EB4243F33502D44954136CFD051CEC66D50D1822A090F14954FF2B76199E15BA61F935F72EDB56EF32F54653B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/image_more_6.webp
                                                                                                                                                                                      Preview:RIFFH...WEBPVP8X........)..S..ALPHT....w`6..R.(S.b.....<.5..&..8-C.iA..`.....f5.'........O.f..GNB.6....D...?.PA.5$.dm.._.VP8 ....P1...**.T.>)..C!.!..4......p...n.d........W............W.}...~.v.x.....|..P.'.o....?....W...?._.%?0}X?.<O.....O..g...Y.S...;..D.Q..>.?..'...c.w....}..W.........s?.} ........._h...b.k.....?.'.....?.............^..........!?......pj....6.(....(.$&...u........U..P.e.<f.....-./*..(..M...../..'u..E..0.4f.IN..J..w.......[....S.J!).o.f..F...~...#e..@.....~.?..X...[PP.ACY.e%.......!?..........s.'.[k...#..%v<?.L..(...$o........_.........\..9.../....U.i..M..F..T.Z..h-V[j...jX.;..C....VC}Y.6...`.R%...0..MX.[!.......fU.\..!....2(Zy..........p[..)>..\.4F..4.-..}..~....A=0.....w.j..a.Q..dB+.fG9......yTo...{.NAh.N'4.R...8..L|=d..{.S..yK.,.S;..V.Au..K.....l.l.%.?...<.Q........4...(.cb.N...a...]...>;.|.^...`.J...hp..F.<..Wve.OD....8p...g..G..r.,<.%(...w....!....$.=...P.........{.d....e....[vu8.T7'.x...%'..i..9!.Y...i.......uX,p+....w..[.

                                                                                                                                                                                      Chrome Cache Entry: 364

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 1520 x 885, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):57415
                                                                                                                                                                                      Entropy (8bit):7.714040814048473
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:prxHV0LsrNK1KssPfla+zSS40imFJZAKEn5oC:LosrNK1BM9a2XimFJZALf
                                                                                                                                                                                      MD5:1FAC4DF9B20EAD5A43B7801A9576BAD8
                                                                                                                                                                                      SHA1:C02E2C895BA6C3E565D4B0D12CEE24CD6ACC27E6
                                                                                                                                                                                      SHA-256:0F5210C9EC14B9EBE309F7994F7BA3A5F35058623235DA62D7DB4778700AF1D4
                                                                                                                                                                                      SHA-512:21FB6CA7ABDD50D1CA3B73DF910927A7A8719578B454FEBAE372795357166FF455367F7D0E83352D718A7F243B053734C10E36FF48E029DF7B9F2B1816154F6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/activity/activity-update3.png
                                                                                                                                                                                      Preview:.PNG........IHDR.......u.....0..&....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^......}....]p.^....#.bc...`.#,....`.%#F.$$..f,!!1b...F..H3.hF#..T...*.......M>.....&...|......[66............3..y.......>...u{N...>.........@g!.................................@..........t .|........:..>.....................D.........@.".................................@..........t .|........:..>.....................D.........@.".................................@..........t .|........:..>.....................D.........@."..............u.<.n.1....;'............=.F..............-..Ia.^'.C.O..g...t;.|.......5!..v^=.....f....=Ggs.n>*...~(s.....z,.'........P...`.?...}VM..8.9...WG..U.v..U..H.....h............jB._..k.<Q2.NW......6......._;.<+.....c9...Y..<xT~.......]...$....cS.r.....}nC...!...j..zl..O...s.]....>.&..3.T{.......f..L."........).........95-..!.O....:8..O..WBn.....{g><...........v.............a..]..gm.p`..V.|=...g..f.f....:6....y%s.j.D......:...e

                                                                                                                                                                                      Chrome Cache Entry: 365

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2711
                                                                                                                                                                                      Entropy (8bit):7.852022310856631
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:lVSwDSYzzOJtg2oZVp8OkhVES6bo9G5yZQwffYj7JQXDeKDa3kFoEP8/Z6f1ZlEr:lVSwDSizOJtgBpXS0sZhXmJQXDDa0WEc
                                                                                                                                                                                      MD5:B6D07579739BD1129E692D6A7F393756
                                                                                                                                                                                      SHA1:A51465B52F2B77BA7BD073107541877668F7D9E9
                                                                                                                                                                                      SHA-256:45E16FE9A2E7266228404F5093C1A6D87FC1B7EDF6993A242DE7EEDFDA28D8CD
                                                                                                                                                                                      SHA-512:9D3F6AD7EBB9BF88FF638ED66014CD8706104FD298FB3BC9070184973149B300F70F073F356D591EB26596FD28EFFB31B9E68D712918C9D3DCF6DE09DE48E682
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/footer-icon-2.png
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W......^IDAThC.Z..\e.>.?.{..,...[...by4...@..F.$...J!J.....E@TX..>".|!. .. J.Q..`Zk...T^....m...;wwf...d:...-&.d...{.....s..!......I.&&&...4...'i...0.+.......Z... .)......2.."r...Xk...c....DdK.Z.d.y.P(..P./.y. ........1.I~.....HZDR....5..H...1. ..Z.`A..{..3..|.\.2.|LD. .N....;;.W7J.>..$o&..B.0.+.....p../......O..G^!y..;...x/ .]p?.ONN....O....a..X.St(...e..........Rb.[.n.\..x.....-........u...3]_...J..S....s..;X.a]..Y&3..4'J._..{5..w...$.J.."r.&m.....OE..R..r.U.QZm..KCiG.Z=.../...y.d.R..O.".t........N...U....L&3\..."y..,..|..5...>44.u.$..............D...~..k.4..7Sa..J..$.......[..$......8.q._..j.q.|.In.f..3..s.....D.......ME.q...k.&..=...m.$...........a. $......y.....#$o..ZDr......8=....m..g...l.O..j..."..hk.....>...%...s... ..CE.>.....n.y.g...gZ;.(..K.n.+...Jrs..g...j...(.J...>?.p&I.{Z......R....y.5....WD.<.}m..'. .K..b. ...Q...(".G].~...$w...Z..A.FEd..gf.Q.Gi.Z.uoI.R$.....$m......7...1..w.`)....|.B..l....8......D.>..

                                                                                                                                                                                      Chrome Cache Entry: 366

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):376
                                                                                                                                                                                      Entropy (8bit):6.890802046110792
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:DZwIU7ruqkhiyuZxYVoeRU+P9FRGJTIobilO+QxYO0ssdxI8jEmNl9Ttdk:UvlkQZOM+Pn+daIYh9O8jEmNTt2
                                                                                                                                                                                      MD5:3F8CBF6299FBFB7875D4412ACEDEAF4A
                                                                                                                                                                                      SHA1:2CEA74A116506B74B96A14AC118FB0AC8D553DAE
                                                                                                                                                                                      SHA-256:B5CDAD13A7242EB7EF09EE51E60C05F4AD0174F2214E824A1839B93983005A47
                                                                                                                                                                                      SHA-512:CE66B310F2694FD32D901BEC525924805CE744565CF4CB982CC1F7B556AFAAB5269429D1A09EBBB10766C1BF9AB655D67192098C795F6CB3E4A1DE662C0C28D2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFp...WEBPVP8X........?..?..VP8L(.../?.....m.=z...;Hi..m.s..S.m.m[......T.".?.|}..X.7-...+.T2s.......U....k).T..g....2.........@%3...x..B..B!w.....!.@....H.7.^...`F.8....@?e..p(....r...F......,..B...I...kB...!w.....2.K..`(.;@.dp<0-d.......2X.8...T.9..4..=...VQw....?..P.Q..c.........pk...._.../.?.3u.Y.6....j._..53W...K....EXIF"...II*.......1...............Picasa..

                                                                                                                                                                                      Chrome Cache Entry: 367

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):121992
                                                                                                                                                                                      Entropy (8bit):7.996706160796436
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:3072:gYzuKeEbcB+wGo63eqqjhNJas2UVziFk/LPsD12OjDk:hiKDcB+wGo63e79/aSV6krU2Oc
                                                                                                                                                                                      MD5:06E82BFAC9B919B5E86C35CCB522ADC7
                                                                                                                                                                                      SHA1:81052BD4C091908CEF13EBB7660CB713E53A4FEF
                                                                                                                                                                                      SHA-256:1B0C7779ECCA2B676CF0CF667F81357491A031EBB2A8FC8FD84DCF9AD6B6FE20
                                                                                                                                                                                      SHA-512:10B488C742768D80525569B34493DE2EE7D82AB0516259BFD2A5239935FA1A98DB045035D2D09DC8436B6C4B8D3A2BC05E0DDEC26838DF2F4D0F0D0712E73FB6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............ALPH0.....@..:%...(.....1...]k.p......;..W..{...f.sBX@b..!^.......y._....8.#I2...u.<.2E...WUl..Z..c..w..q.j.\%...J.T.R{$..Rna.*yhHhhH..<J.R..Q.,.A-.D.j..>...j.....,...(.r..`../VQ{...j...*.....]|._a!.....3.z..@L...R3$.......z..M.....d.T....&N.......{....7i...N.7~....Z...L.y.....Q.-f....G<A.<Nj.f.....V...8`.0W.<=.....@....._..R.e'...6...9...t(=#..Xn,7V<..Y3R....X+.FK..t..Q...RM.....x,~.u.Wn,..=..6n.~..S.lc.q....oX.v...Y.ju.....t.J...j...,.....4....|i..0]..Y.......E.M...7K\.....Z..7......i.."1.1._J.;{...>..Y..3o.....m..h...?.....\d...[S..qr...spk.z.9..Q...{..`._A[..."./SO.m..?.....+E>4%..]._.y.V.Js...-....r.?M..~l...%.S.~e..f;).@.W......j.."..u.X...D.5_G.3.....l..z32.."'...c.%G...l..l.W.d...M..uy..\m.o.S....m~...$U........".._<...<...@V..{....J.Q.t.......bf...wO.w.saO..D...E.+h...%.......z...3..|..U9.-.>*.X.%Y.-.~.Ma.Oj.!.y.%7.....v..5;.$..&.aF..E.XV#f.T....eF."....x<.=..47V|u.'L...&.....#"/,...nB

                                                                                                                                                                                      Chrome Cache Entry: 368

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):86952
                                                                                                                                                                                      Entropy (8bit):7.9969412048808985
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:1536:Y2Jgn4o/EQo5EH4zPLQC35S6mzgth4dwxX8clPa+wgyQ9hXJD+0prxndmH5R:Y2JU/Exo8Lb35S6Rv4ds8cxwgy2X40pK
                                                                                                                                                                                      MD5:5C05C9598B9EE99C88672680584F8BDF
                                                                                                                                                                                      SHA1:5EA0C74D794A754D31F39052F05B76A14A1BB14D
                                                                                                                                                                                      SHA-256:51736A81D661E4851CC415BE72D56BD1917DE7FDB708EFAD43A605AD26D9B596
                                                                                                                                                                                      SHA-512:C13C6D51D24DEB5B4B7E8A2119B074969D0052E707F5441E65C7A2ADC5943E5CD97DFEFC3375ADF252E41694AAC5A9AAA41C8CABE72FAA6083F7654B32578770
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.S..WEBPVP8L.S../..;.M@l.6l..VdF..........*(...$..9..O.$..vN.e...{...f$;.sFC..y;<........y...%..w.].M.:O.."...$G.....s..6......e..-..K..O'.If..%$]..Nv...k.vf..oB`...=.\+........][jt.H...M..#....m...;.J.......&..&.:.\]e.]I.$...J.R.*,...0..^d.g......KR*......Z$..Li.... ig.&....3}...>...=.3.8..H...J.f$..Se`.}....s ./&.{.-U...U#.$......*I".....n..8.;.OTW........69<..l...o.%...n.m.g..a.!I|..H.....-..I.F.@.E..{o...?.... .. ..q..q.s...j{..Z.3.c.1.%=s.....e.}..f.0B.!(k....uRn..a=...?.Z..R.r>..I.d.?....-..+..."#g-.,G..T..[ET(.E..)KYD\......@x.......r.//..\....%G..$.....PZ.[F&i...{dVf..4.o..W.5..m;.].1......3qb..c1..x.^..]M(.X#.....s$..:..7....z.U.d{......4...Q..+p8hX.kH...Ba...9e.d.=...O.O\..nv.....CADD....7.G...c...?..\.....g{0.@.J.'.2....G.0!.P.Rtny...y.+....qX...!......-...|....6..z.;..^..D.,.##.Rr.y.e*.......Q.(.;7.U..+........Xj..+Z-.b.Y.@.Lo....... .>.......7...F.Q.R...k.}(l.)E$....jI4...k..K8.....J<..A|6.2.>.G...6G.y.....H.D...../.

                                                                                                                                                                                      Chrome Cache Entry: 369

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (31803)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):31904
                                                                                                                                                                                      Entropy (8bit):5.464187984108645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:aCn0VmiVxAtMTvnSr4l9d+eawJubAw5qHm6oQnYxZGplj:aC3iVyeTvnS87dsSuJqG6hnYxAj
                                                                                                                                                                                      MD5:017385B552F7E0D979E2E2FE6F324015
                                                                                                                                                                                      SHA1:F89BAD36F939A1D885991580CEB064FC668DB7A2
                                                                                                                                                                                      SHA-256:78FC260A16DBBD76EC3B4DA56CCDC7A076D21D31C501E0A17A4175C4A25D95EA
                                                                                                                                                                                      SHA-512:D91E152466A606E769CC2D4D4DA4A4BAC5CFED0922518BC42A1A490317950AA2C3B205B83AAB73A2B646A6E944DDE100EE9FBE5346589AA0703B79BE4768518C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/*! PhotoSwipe - v4.1.3 - 2019-01-08.* http://photoswipe.com.* Copyright (c) 2019 Dmitry Semenov; */.!function(a,b){"function"==typeof define&&define.amd?define(b):"object"==typeof exports?module.exports=b():a.PhotoSwipe=b()}(this,function(){"use strict";var a=function(a,b,c,d){var e={features:null,bind:function(a,b,c,d){var e=(d?"remove":"add")+"EventListener";b=b.split(" ");for(var f=0;f<b.length;f++)b[f]&&a[e](b[f],c,!1)},isArray:function(a){return a instanceof Array},createEl:function(a,b){var c=document.createElement(b||"div");return a&&(c.className=a),c},getScrollY:function(){var a=window.pageYOffset;return void 0!==a?a:document.documentElement.scrollTop},unbind:function(a,b,c){e.bind(a,b,c,!0)},removeClass:function(a,b){var c=new RegExp("(\\s|^)"+b+"(\\s|$)");a.className=a.className.replace(c," ").replace(/^\s\s*/,"").replace(/\s\s*$/,"")},addClass:function(a,b){e.hasClass(a,b)||(a.className+=(a.className?" ":"")+b)},hasClass:function(a,b){return a.className&&new RegExp("(^|\\s)

                                                                                                                                                                                      Chrome Cache Entry: 370

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):39328
                                                                                                                                                                                      Entropy (8bit):7.994553634657984
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:A/WR0bD0TlgaAMvBzBy8EWlua4yrg0yPlnGMMZmXVTI8Wgc1W6:us0bohfzOWlu25qliZmFpzuR
                                                                                                                                                                                      MD5:D99582F67A3ECE0D09B9D9D540FE885A
                                                                                                                                                                                      SHA1:87DD927AD44F8A9EB59BBC13DBE8F89F5E7A2AEC
                                                                                                                                                                                      SHA-256:ABABC2F9BC320FF88E90359EBE4FADDBC51A98C35E2C5783CCF0D5872F3E0C88
                                                                                                                                                                                      SHA-512:0BE4FDC1E427AA9072290A21C19B8D0C0619DC80999FDF9C5DB5AF6B67235D38B87F8CBE817877C6AFCF7FA0774A76451D2D5F7AF7FA1A96344742FE60EEA871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ....0....*..(.>i(.E."!.[..@...6........F3=Y.t..~....O ...O....k..v.../...}......+....p.._...r=.~.z......{.....g.G.w.........{3~.....zu..|5.t.....u...........x.......S............3}....W.....'...#.....|..M..._......o}....N..W.w..j...O........./.....v.`?.?..............u.........?..o~..........._........y......l.....~....w.y......F...7^.e[..@Mhl....o...Kx.ez....D.^...Kx.'y~...=s(nr.<..{.3g.)..3.e.j.u..?h".P5J%G....v:...)`..xD.#!.H..cv.Z.Q....Y9.mF....h.-....rSX..j3...-m^..n....[......R.z.........u~....nB....!(I.S.V.x.:..=:.(..h...`.\...jE79..-$.~R.a..]m.....k./..M.....[z..4(...cvu.. .CEU.$..w*.f...f.Y.l'r.r/S.Yh..G-,.Ew~.u.*.C...]ynF.?...8.l+X2}^{p...G..2.R...........:xrHW.zU...@{.b..w...?].........-..'.....?.W.S.t..z.e....h..L.0.^....uq.Q.p z...8r.I...v3......9..K"hC?.../q....~....!Q.../..q..............5.Z....V$=...u...J`[8..;h.....l.;..W.b.{.W).W1..E.D....../...1i..}....C.).9....[y.`.....Dno..D..qC9.....E...p.*d......Z*!.p(T.

                                                                                                                                                                                      Chrome Cache Entry: 371

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42322
                                                                                                                                                                                      Entropy (8bit):7.99596563855182
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:eVTTtywwXjTdLjwT35hjsan6BzmcfM6DDyLRB3Qu8zgy1vXUGFcndCKLev4:eVHvwtLUhQa6Bz/MSDeRBQuigydpuB44
                                                                                                                                                                                      MD5:28072429C2565CD8226F3FE62774AA3A
                                                                                                                                                                                      SHA1:AC550713A85133748B331306EF7FF084826B4CBD
                                                                                                                                                                                      SHA-256:410CF2E9600AE8EC37701944F7ECCD2EA54E82D91FF19559F4E8823C1E344958
                                                                                                                                                                                      SHA-512:39B59CF822578E57AAA6F3888B425D385BDA24D8511A4CE89CA26274B497619880A1C2C8DBE6C21F2C531AC15A2A2B5D82C2938ED98BCDBEAEC1D07006A5DBFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFJ...WEBPVP8 >........*..(.>m*.E."..07.@..fm-*.q.[....?.b.......HnM...ZM.w........y....c..._.oa..?..S.......c............~.?.......Q.9.#....g..^.......?w=..........{....(._...o.|......._/.....g..........?..S...... .S...c.......^....S....../._..~..........=\.5.W...........~.>....k.O....._........W..........n...O..._._.......e.....'...../........#)'.u{u...4$.e0d...I4..);^...R..i.@..4...(...GH......N...k...=..w.]WJ./. ..|.G..0..f..........U....P6~.h=....#...|+...}...T.67.Vsn.F.....a...c.k.l.......t..:.(...zx...0.'..,-....;..V^..a".Q..."xZ..`.(6......V..s..........f.fe..djb..*..{#Im......x.)....V<!U~..YG...&c...G.W.g......z..C...x....T..i.......N..Mt...o.iL...;3J}H.n.WY9%.C....q..u....T..!....!...v.3.*._...4....s}.tV.7./...jx.S[..RLH..l..V.4>..../G....t...6.TO..F2..c....I.....Vo....._..k}....&.l..xs..@0..Jw...e.h....mN:.....T?..T...+...L'.>.4..=..kOc....9......H.8..."J?*E..@..5p..[.2oG....z.....F.i.o..........k.W.ub.......Z.7.>..5.e....A.*.*P\.

                                                                                                                                                                                      Chrome Cache Entry: 372

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 416x234, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):23680
                                                                                                                                                                                      Entropy (8bit):7.9913839102467685
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:384:XGv70G033zFQvH8VfKJ+A98qxypMFz2k3Qmk3v+erwICKWhMugnCW:2vAH33zF7BKA0yp82kAd/Frwoq/gCW
                                                                                                                                                                                      MD5:DA50F8F49D8E88F6E364E911B1BF4467
                                                                                                                                                                                      SHA1:8770896A042707E886621971CADFABD48D1D4317
                                                                                                                                                                                      SHA-256:30364A07D3B398559DF76948F9645391BBD6F2F4348F28E9F31F8981B228F775
                                                                                                                                                                                      SHA-512:5B13DF62EF683B3ABF012434BCA37BEFCF400039677C01D951E76D6468693F5243E0479FBE4646AE1CBDBCFDD766C16C9FB6CA33A173F8D3D42DF695C643DF79
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/dl3h4f8JvKbmL4jtmqiTWof6bU6W2mKCzOmAHgdf0PUCanyZ0qQ19oXqRgn79R8qXKwV=w416-h235-rw
                                                                                                                                                                                      Preview:RIFFx\..WEBPVP8 l\..0/...*....>]&.E..!.;&<8...e.B.Y}...|...<../..Q.?....z_3.......W././p/...|.}l~.z..s......./..._.j~.?......c...._..p.._.?...~.|,.l.....;.3...G....P....~i.7./..7._.....?S_......<..z...?.o...w..3.?P.o...|..._i.3._......~............w.......:>J..._._.?...?..j...k.s.7.....?3=.~....o....._...........s..G.o.#.zxl<a..j.....u*{.P......V85^..Z.................R..M|..}...O.q.!.6..4o.+.+./..1..(..G1.-.uw....h...!....Vl.#V..9.........H...R....,2x...1J....r..Q.$..n......c..#"...n....[...D....f/.*./....o..dbv.....,..H.9..#.+.K...G.|..G....A.!.H...?....s.......}.m..S.V..:..i.Sa.]|.0.pf.I7a.t j.r.,.....X%..z..|.....;...S...e...#O...p..1..M.9rXK.....>.5F.kY+mSF..0....4u$.8...w...E.j .t..%........"...(....G.}.@.R.....1_.TyJf.......Y=}..E.5:....]NL..7K.....&..*...<..._{yd.hi.o...>KcQ{...Zm..iQ..NJ'..m2f...4....n...[.U..qY.)..#.dD.w....{.u.>,9.R.j..'kr.u....N......9..nM...Wkoq..+r^eE.o.. .A.M?t.....sf.]*..{..b_....g;..Y.M...%.../zZ

                                                                                                                                                                                      Chrome Cache Entry: 373

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):13
                                                                                                                                                                                      Entropy (8bit):2.7773627950641693
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:qVZPV:qzd
                                                                                                                                                                                      MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                                                                                      SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                                                                                      SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                                                                                      SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://td.doubleclick.net/td/ga/rul?tid=G-9232N9ERWJ&gacid=1533494344.1727546622&gtm=45je49p0v9134485199za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&_ng=1&aip=1&fledge=1&frm=0&tag_exp=101671035~101747727&z=2131939924
                                                                                                                                                                                      Preview:<html></html>

                                                                                                                                                                                      Chrome Cache Entry: 374

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):200
                                                                                                                                                                                      Entropy (8bit):6.878063612294382
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:wAi1Z6iB1toFkCoH+GN2jQPRwS9gJY5derhz6:wd1Eqt8qNN2jaRxgJY5Ec
                                                                                                                                                                                      MD5:26AE874F3B7051BC5B112960C251080F
                                                                                                                                                                                      SHA1:1D6B38F7FE58DC79CC66CC0A3EE42CAAA096B686
                                                                                                                                                                                      SHA-256:8C66B3CB207515328AC21BDBBDA1B90A74D7CAC66267352048BFD7E4E1EFE627
                                                                                                                                                                                      SHA-512:88DBFE63B9A7374528308BD4AC891535C310FFC2277C3A44004772ACCEA7115D8A1DF77ECB56EDF573000DF4AFC79E7E9524B4FB8C8E8DBAC2384860306F0C31
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/iFstqoxDElUVv4T3KxkxP3OTcuFvWF5ZQQjT7aIxy4n2uaVigCCykxeG6EZV9FQ10X1itPj1oORm=s20-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../....58l.F....._..2.. .p[[..L.nx.......!V.....R..A...........x....>b.z[..j{....%~.{..~+N.sUy.G.....D...x.poN...,`....>....o...Z.*....u...,}...^..W...v..Z.u..^.`dg`j.|...q....

                                                                                                                                                                                      Chrome Cache Entry: 375

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):16610
                                                                                                                                                                                      Entropy (8bit):4.803352696245373
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:YE/BhwHAj5uKjBjFm1F5ZoDdFjGPRASUDpxU4WHhaL/BaDmFr3o7xSR2JozuDUYP:HfFm1FboDdJGPRRUDbWHh9mFr47xSRKP
                                                                                                                                                                                      MD5:8832EAD55A3BE5690CAE03816BA4BEDB
                                                                                                                                                                                      SHA1:9A05C880C3B5AD6F97ACE2A696EF42B63E71A73D
                                                                                                                                                                                      SHA-256:CE2AD998CA601D74F003C0359707FE2507055D2FF7FA1939F0B064CB929E21BB
                                                                                                                                                                                      SHA-512:735AFFFC727E096DF6C717049946E0268B62534FE70AC240C6322D33D912312CF388E076B6EFD82CB8EA09E2F667A722C4848817B559AAF0C020F67836033E0F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/css/home/download-new.css
                                                                                                                                                                                      Preview:.clearfix:after{. height: 0;. content: ".";. display: block;. visibility: hidden;. clear: both;. overflow: hidden;.}..body{. background: #fff;.}.p,span{. margin: 0;. padding: 0;.}..img{. display: block;. border:0;.}..container{. margin-top: 50px;. width: 100%;. background: #fff;. padding-bottom: 50px;.}..container-full{. width: 1200px;. margin: 0 auto;. padding-top: 100px;.}..container-full .left-bar{. float: left;. width: 320px;. box-sizing: border-box;. padding: 0 30px;.}..container-full .left-bar .download-icon{. padding-bottom: 50px;.}..container-full .left-bar .logo-icon{. width: 120px;. height: 120px;. margin: 0 auto 30px;.}..container-full .left-bar .logo-icon img{. display: block;. width: 100%;.}..container-full .left-bar .download-link{. display: block;. width: 100%;. margin: 0 auto;.}..container-full .left-bar .download-link-btn{. display: block;. width: 100%;. padding: 15px

                                                                                                                                                                                      Chrome Cache Entry: 376

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14521
                                                                                                                                                                                      Entropy (8bit):7.8525415109461765
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:6aLLNbRieKueQDm9Eep0faWdHwBgjXJwRy:6aLHiLueQ5Wg7Jwy
                                                                                                                                                                                      MD5:AF3B657F0E50DE0A91216E8D29BBA192
                                                                                                                                                                                      SHA1:451933DF586C8616D80A7E5DF423EAF173011F3B
                                                                                                                                                                                      SHA-256:C7824F47A12CEDDF63A07314DDFDD56C0DF16FF0728A53AFE4FF4B0194B70DF8
                                                                                                                                                                                      SHA-512:0232C6831D29829052F9BEEE896743B1AAF58E8C3E90E076C0AC17533CDFB4612A05620E23966ABA24772A22BC23C3635522656B81CD91650B7B991D11F24748
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF............................. %. .!% %%..(10-(-+5=PB58K9.-EaEKSV[\[2AemdXlPY[W......./..0WB7=WWWWXWW_WWWW_]WWWWXWWWWWWW]WWWWWW_]W]WWWWWWWWWW]WW......h....".......................................>........................!1AQ..."Raq....2..#B.....Sbr..$3...C...............................2..........................!Q1Aa"q..2....#B.3Rb..............?..........................................................................................................................................:.C..W.>.W.....B.FZ..9......._..._4:...S..O............*.hu..B.Dk....*.hu...U|.....N..>.X:.A..Y|....S./..S..O.....j......._5>....:...9`......Y|..V.S./.4*t5..r....o5>...@..._.B.C^.g(._.......}....Y|....z}..u~.[.O....+y..........W.......}....Y|....z}..u~.[.O....+y..........W.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._...............hT.k....~...Y|........h..k....~...Y|.......h..k....z...

                                                                                                                                                                                      Chrome Cache Entry: 377

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 458 x 458, 4-bit colormap, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):465
                                                                                                                                                                                      Entropy (8bit):6.05785253746322
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7ElAi7XzyE2dbfsnX7rG6EzstzWXcdXy3x:EDE2GPkAoM1w
                                                                                                                                                                                      MD5:143B0F6438909F4F68948A08FC48AF24
                                                                                                                                                                                      SHA1:F1083367EB950980670440FC20EF482532F1289B
                                                                                                                                                                                      SHA-256:16A808DE19CC4D477CA3A807F630156644F7CB0DB5D8CB6E1B69D758524FA253
                                                                                                                                                                                      SHA-512:8E4D74862B28B897C2E469C74BF4D36B157CBBAF9E5AF9DD21443732F9D68E6D0836F9E92BF06265EEFC84E6F50676BCF118937B0C0D9E57DA0B5EDBC11B0735
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/dots-1.png
                                                                                                                                                                                      Preview:.PNG........IHDR.............q......0PLTE......,.....-..-..,..-..-..-..-..-..-..-..-.....e.......tRNS...'..........1......bKGD........5IDATx...1.BA.E.?_.6......V..:*.`....b..9.K.....[z.;.F\./..."^.......a.../.c.....a...K....p.........................H.0.6,=.6l]h...k..m..................0.m.D..X.u.mXw.m....!..................|...m..cm...a..a.......................6L..K...[..u...+k....................G.0.6,=.6l]h...k..<....z.f<..z....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 378

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):102
                                                                                                                                                                                      Entropy (8bit):4.921030304008144
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:JSbMqSL1cdXWKQKzaXORdQzXWaee:PLKdXNQKGeOL
                                                                                                                                                                                      MD5:59EE3965FCB16F88E9BDC20B9CD8612E
                                                                                                                                                                                      SHA1:3D93A27E4DAC9DDA01DC5BBCCA9E1F53E827DAF2
                                                                                                                                                                                      SHA-256:020A92F2FB27981D1398F916AE17400F8F11473962EBD858B7BF6901814EDD7B
                                                                                                                                                                                      SHA-512:3E4C07D9CE3DEDE2998A59C32A3FE12D781AAE33C4AFE8D2B9B0D12C18EB96257373098497B5F3C909EC1EDE64FEB4B4074DBDB9678B4D6B019CD64360222849
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:importScripts('https://www.gstatic.com/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/recaptcha__en.js');

                                                                                                                                                                                      Chrome Cache Entry: 379

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):42322
                                                                                                                                                                                      Entropy (8bit):7.99596563855182
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:eVTTtywwXjTdLjwT35hjsan6BzmcfM6DDyLRB3Qu8zgy1vXUGFcndCKLev4:eVHvwtLUhQa6Bz/MSDeRBQuigydpuB44
                                                                                                                                                                                      MD5:28072429C2565CD8226F3FE62774AA3A
                                                                                                                                                                                      SHA1:AC550713A85133748B331306EF7FF084826B4CBD
                                                                                                                                                                                      SHA-256:410CF2E9600AE8EC37701944F7ECCD2EA54E82D91FF19559F4E8823C1E344958
                                                                                                                                                                                      SHA-512:39B59CF822578E57AAA6F3888B425D385BDA24D8511A4CE89CA26274B497619880A1C2C8DBE6C21F2C531AC15A2A2B5D82C2938ED98BCDBEAEC1D07006A5DBFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/mWltTzIsNOiuV8vYRcNozoH9KqsBWYRltJj89xcZFUzk8oN7zrySTUOhQYFjQ6AzNlc=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFJ...WEBPVP8 >........*..(.>m*.E."..07.@..fm-*.q.[....?.b.......HnM...ZM.w........y....c..._.oa..?..S.......c............~.?.......Q.9.#....g..^.......?w=..........{....(._...o.|......._/.....g..........?..S...... .S...c.......^....S....../._..~..........=\.5.W...........~.>....k.O....._........W..........n...O..._._.......e.....'...../........#)'.u{u...4$.e0d...I4..);^...R..i.@..4...(...GH......N...k...=..w.]WJ./. ..|.G..0..f..........U....P6~.h=....#...|+...}...T.67.Vsn.F.....a...c.k.l.......t..:.(...zx...0.'..,-....;..V^..a".Q..."xZ..`.(6......V..s..........f.fe..djb..*..{#Im......x.)....V<!U~..YG...&c...G.W.g......z..C...x....T..i.......N..Mt...o.iL...;3J}H.n.WY9%.C....q..u....T..!....!...v.3.*._...4....s}.tV.7./...jx.S[..RLH..l..V.4>..../G....t...6.TO..F2..c....I.....Vo....._..k}....&.l..xs..@0..Jw...e.h....mN:.....T?..T...+...L'.>.4..=..kOc....9......H.8..."J?*E..@..5p..[.2oG....z.....F.i.o..........k.W.ub.......Z.7.>..5.e....A.*.*P\.

                                                                                                                                                                                      Chrome Cache Entry: 380

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1477
                                                                                                                                                                                      Entropy (8bit):7.3071949812052
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:CatFK2bRVfnqbCwDX39HXjpEGgG59N7WGH2HtqMVpNz/QBzBMVSyKuIy8hDRi2DM:Cgw2HqbDdyq5Ww2RVpNz/edySHuIrDkv
                                                                                                                                                                                      MD5:658F40D68D6BFB60F43B721EBDF6EE21
                                                                                                                                                                                      SHA1:71DCDE26D5D302CE3E1CB147991C0A0FB24FA59F
                                                                                                                                                                                      SHA-256:7EC5D8D5893E23A0FA625C54D91B59DD7873855313B8440894BE6E728A54B4ED
                                                                                                                                                                                      SHA-512:1CC8D4CBAD17AE9D36159E0C41F71DADB583171BB9629232FBB3F26C288473869D35113FD13B085D2B5386961FC0110D4B59FAB54B6D40B05BF8457E3681B70B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/note.png
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@............@PLTE...........................................................................................................................................................................................................................................................................................................................................................................!..%..'..+.....3..7..:..?..?..A..C..C..E..H..I..I..J..K..M..M..M..R..S..V..W..Y..Z.._..a..c..d..e..i..i..j..k..p..q..y...............................................................................................^.7....dtRNS...............!"#$0145PQRSTUVXY]^_bdfoqrt|}~...............................................................bKGD...-.....IDATX..._.A..g.45.S....CMA+.;...KJm........;..O*........E..y.f..G>.}>...;...,caU.....q.;..YH.c.\>...e.cM.0-. .Li....L.S.. .Mn.q.g..........m..5.(.r..|..N.C...`..'..\..g.S.c....b&.......:...b.Ts..4..)...N.....*...G.....&.....E...t.@r...

                                                                                                                                                                                      Chrome Cache Entry: 381

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):34736
                                                                                                                                                                                      Entropy (8bit):7.994831968088191
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:03n7+TtVLG50DX3C0/P+0/hCstO05hP4qK65YgFrXLfBBUmBo:037MeKX3n+8g05VsDgFrXLfwoo
                                                                                                                                                                                      MD5:9F6E8DDF058E07392417009FB91BB655
                                                                                                                                                                                      SHA1:B97A6FD4756779522EE7E1098276478E8EC29E3B
                                                                                                                                                                                      SHA-256:E8ECF31ECAA90B199C1785ABF0FC22B6582081378CB23BF5BB3CEE5C4357866A
                                                                                                                                                                                      SHA-512:8FC862162CA1FD8531B4D8CE4DC22346DED71B13A75B3AA44BC2ADE88AE90A2E18954AD99EC383AC49B411E4B3233803FECE2C8C6941DD35D85502901D7B67A2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/i-lMBe-gqksV3HseN6fI2TyZSjm8y_tXAt5LQxKSdRtHF-y2wJSTN5Yv4y0Wpmep1IM=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*..(.>](.E....+.;p...di....a...~.Y+.i..?3=.../.~...........n=5........^.Z.....m.........c...'.........?..j............{.G.k..?.?..............?..g....._._7.....~p...?....T.....S.'....U..w....z../._..5...........<?{.S....././...........`?..........u.....?......k........^o...?t?.......?.b...a....LAs....a.ed.. ..9.[x+qt..#...MP..4X.M.L.`\{.vs..........dz.2.Sq.......L..).ciu....Q..b....L."{...4.j..[Rx...d.6...H....^....n..$*=..f~..(].s.....h.[......J...#...Ro...t..-@....D..c.N+3.....L..@.b..R.aP..b}..]C.yZ..6C".......]3...)YJM..L.q.|..ydc.'.....f.o+1F2...m\hS@.r.j...`n.Ou.V.. d.o.x.vfLht....5H....;6..1.7.xy0.;>...B._VB...K.}W[..*=.d.Z.......W..&...p.+...'.7. ...9S+5.G.....j....T..o....@.CY.-...".....~u...7........^....Ig.......u.....SF[....B..p=w...1]..\7c.......j..>....(.TL........A{...f.;...a..D9..i}.. ..&.1.iCS=Z...+9...X....c4L.....0....0.y.F........&..rN..Q4...F*...)Sl..N.d...!@........p.....F..X..S.x....s..}...$..`

                                                                                                                                                                                      Chrome Cache Entry: 382

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (2283)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):206821
                                                                                                                                                                                      Entropy (8bit):5.506034054993372
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:5oN0qTAiHf0BtVNZdicI+JtgOZOtuWk29itiQ/Zc0xhezogSI9vYrzQb4K3PHiz:5oN0qTAiHf0BtVNZdicI+JPZw3k29itF
                                                                                                                                                                                      MD5:B51F7E7F1E9F86A40B400FF9E9E59C34
                                                                                                                                                                                      SHA1:9D1D8022C0101B658D2366551E9E934FA73B77FC
                                                                                                                                                                                      SHA-256:C63F631D2FBAD3875B925B62DD7B14D7110E3AC2C876A3F63027918541B51E82
                                                                                                                                                                                      SHA-512:A345B84F6C3AD519A9C58604D77CE5ECA0476AC94BE760C6D2D8E7749F37A41D1519572EB271D04D89DA3B6E34C7B3CF7157ACCFD87609E6A4EE58BE974CEFE1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/excm=_b,_tp,appdetailsview/ed=1/dg=0/wt=2/ujg=1/rs=AB1caFU2TO-tW35rDTzdtm8P7C_TpmJ2lA/m=_b,_tp"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x19b747, 0x103eba3, 0x3f00c093, 0x18c1c783, 0x1, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.*/.var baa,daa,iaa,kaa,Ia,saa,xaa,zaa,db,gb,Baa,Caa,Daa,Eaa,lb,nb,Gaa,Iaa,Kaa,sb,Naa,Paa,Qaa,Taa,Waa,Yaa,Zaa,cba,fba,$aa,eba,dba,bba,aba,gba,lba,mba,Nb,qba,tba,vba,uba,wba,bc,ac,zba,ic,Dba,Eba,Gba,Fba,Iba,Jba,Kba,Mba,Lba,Pba,tc,Qba,Rba,Sba,uc,Uba,Vba,xc,Xba,Zba,$ba,Lc,bca,cca,Ic,gca,hca,Hc,Jc,kca,rca,wca,xca,yca,Zc,Bca,vca,hd,Tca,gda,xd,ida,yd,mda,oda,Cd,vda,yda,xda,zda,Ada,Bda,Cda,Dda,Fda,Gda,Kda,Mda,Rda,Sda,Zda,$da,aea,

                                                                                                                                                                                      Chrome Cache Entry: 383

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 162924, version 1.0
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):120544
                                                                                                                                                                                      Entropy (8bit):7.998297557372101
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:3072:XdhkQyBlHVVYwHUFDrzXtPz/qJwZmUyhjpimMS6DV:wQyBBvYw0FD/tPWJZjI3PV
                                                                                                                                                                                      MD5:981A6C3A7A7C7C3480E0E6399A490147
                                                                                                                                                                                      SHA1:DA8042E74A356654F5DC961FFBA3A5FB67DBFB6D
                                                                                                                                                                                      SHA-256:72645694818044F4A4DEC5F5250E5CDA3B7467AAD4EB798629EB84C8FF2B3631
                                                                                                                                                                                      SHA-512:2512150B30C0B8C40C7E8A9A21DDB10B3CC2C1C9D2BF260EB14378778716825B96839536DC50BD3D81FE5A6ADAEAE06954F2740E26108F53B40659BC846A7781
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://fonts.gstatic.com/s/materialiconsextended/v151/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvJ.woff2
                                                                                                                                                                                      Preview:wOF2......|l..........|..................................`..P..........N.....6.$.... .... [.m.A.B.$...c....5s/E...%.u..v..J6...:......;............$........@..M..... 8.HA.6%R...tB ..D..M".f.$G.....<....~.y;..R..23.S.T...p...'V{|u.,S....Z...lZ)..Dc..D..;=n...V...<.X6...h.......:sw.....T.6.eF..!=*.f..H\..dDd*.q"s.E.Q......JT..v..#Mf"sH}A.>.....q.h.mLC...Q..Cv...+|.u......6..B...I......K..I...R.[..m(...P<B."R.Ap.f.j:.o...\o..L..G3Yn.C..........\rI..$$!DH.!....v0r.E...p..WK.v...muW...*X.[. ......j...1\U..8V.&.X..i.T^TO..^\......&.g2Iv....>.J(.T.*..y...v....4.f..a....$.K...M-5...1D.ya...'.'...A ....!.@..c...$.D.3q..:...:&O.rV..V..v.m...[-.Z..m.......:o......$}.h..i.N.FH.$(..Zq....v...k. ._.A...J&.J..D.......>...~!...H.".$........_...;v...*gU....W Y3lI...;.....RG.....|.rw.. ..=@.....N.....=.W..=O.(...`..M......Y..&.O. R..'0.~6@$.4f.`I@.dV{..YJ[j`v).1(.L.."(oO...R...cI(.l.K..P,1.C.b....A=,u.B....;wm..H{.>......8e.8d.2.~.4.CDDDDDDDD..|.Z..s.G!.._.....

                                                                                                                                                                                      Chrome Cache Entry: 384

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):9550
                                                                                                                                                                                      Entropy (8bit):7.971439000038557
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:SAfXrP8p7gZ3Rwn0Tp1C/PXWT2ebdoWjMh8XNBOkxTRFex0kxoyUr:lfXo7gZ3Rw8p1C/PGiebdoWjMcUk5ROM
                                                                                                                                                                                      MD5:34ACE6A395DA2BDBD1967DAD331B91D3
                                                                                                                                                                                      SHA1:85594FF50B11469D6CCD8F8678FA5F57F696CE95
                                                                                                                                                                                      SHA-256:B3B00AC6557B0452D11EACAAAD459541F6739238152D38889A73D35CF927872F
                                                                                                                                                                                      SHA-512:C6EEF3AC2D57893C0E19EF6A9F24A1FBA876BE159267274224C9673299B1C37F4E38CAC6FBF6F9BC50F6CAA3F9549253F969A84DC68CE5D2C1FF495D250AB31F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/n9CeusCmd-m3uzx8dANuIBorYwG8L5ZbEdkYfVhIn5riLqMiviFPnEuzUveNXLdoVvew=s64-rw
                                                                                                                                                                                      Preview:RIFFF%..WEBPVP8X........?..?..VP8L.$../?...M(j.H.d...........qt. X.U......j.m.:..D......p....m$IjF`1...#....*V.$......f.....Bq...P..P..&.........%D....A0..'....q%..T0.....>]...{.../..<..)E.g..Q#...p^a.Sq.+..9c.B..nT.1.X.....N.....4.x.._..h.k..]p.A.830q .......5A.q'..v.......Zh....v..k........E...#.G...F.....a7.....h)YI.<...m..m...U..m..Y..]go.6^.Y3..b..m..j...7.0.. A2D'B.hJWR.K......49.....Sw.*q%.p....C....{.'....J..;U..)..w.mY...2g..P.eA2V..-@)..W..vU./.$.(..(r.U3c#22+..F(h.Y.....!..B....u.U.:.0Z.(`q.....P..%_..,..9.K.....0...EE.%..7*.g+.........E;.?j...?T}.?...{l].s......._....3._..M..)JD.b....6........o..F.=.w.<].m..t..+N......=?.>x..>...oq.7......b...J.>v..O...v....nx...>I].e.....L.7}X..oO..:3....G...z~.t.....\..c%#w.>..Fy....o6..C.b..........}...j..U.DU.Ge..'...n.m.\.0.....?..pr\.]...W.+....9W.u..o=....}.rUx2.K1...F......\t.I...g....=t..\zzX.........k.q.~(.....>.......[.'.G~...:...}...={...p....`..~....6......0QE.T.w*...ZM......?..

                                                                                                                                                                                      Chrome Cache Entry: 385

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):9270
                                                                                                                                                                                      Entropy (8bit):7.973786790952994
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:IIjELAJ6wo3pBvjZZXqtHxxZsMSqfQ5XHfJ889UqDw/GAmd:IIj+A4xdsfxX+OzSd
                                                                                                                                                                                      MD5:664690CC29246D3BB6257D8E7F790343
                                                                                                                                                                                      SHA1:19559A7E8B91BAD19798AC44BECBD3E376281CAD
                                                                                                                                                                                      SHA-256:2441EFA89E8D41238794A3C53F1223161A222B212CE6BFBF57B0E26BE9F4D0C8
                                                                                                                                                                                      SHA-512:835699F095AC4078A71F64903463D035E55D4D687B7C79991EDDB2B1A660A2F79A5ED0BDF1CC58D9D9DAD1D5BD25C12F38128ECE07478616FA768EF63F8C2517
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.$..WEBPVP8L"$../?...M(l..Ar...G.G{..c..m.{.R...?..6.D..^0n#IQ.C...?.....n.p[...E.N.._..E...m#I.....>...........wb...3+#.nfs.../..e.........9_......[+.0..a{{..a.\s....IND.Z.....|..r.<./..}....#.S.h.S....^H~w...G'..pS......a<....D...,.%....m.j+g.s...b.0s.jH8iN..U........`[...Cn.L..c.s..}?/~.Q..Hgu.E...O.....N.$9.......9....p.pP..|.......P.2.1..<..h6.}.q....N.;...k..m.m....}]k..v.F.s.q...O#I..$.#.\....5..\.......m.Kwffff.ff..*..#3..0I.{...m....*U]...=....m.m.m..Y..rM....+.Jr..yD\..9..J..".oz~,D..xC....^..5..u^|..|.......;.x}...:+=&..li.he.I..E..~......".'..].R..{...w@..*6...%...J.27w.b=.h.A.N7...X..Q`..M.E=.HQ...R. .Hz/ .f.... .jM.p...._?..Q:h|1.KZ.U.a....0|..9.B?.B.^.. ....CH...&N.*....@..D.@.L....o.......1..R...r.!2...z^_sG..@..c>u..b...i....8B{)[e.]..~.w.l........q.U....4*(.B..wB#8DZ%.&.y...)+.k.mjx2q.E.5q...*.4:.F....]..'.....Td.....{.Gw.T....:..."..yk.W|....5o.*...;....q.kTB.I....@.....Yl.8.1c..%.&.-.P.H....

                                                                                                                                                                                      Chrome Cache Entry: 386

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8702
                                                                                                                                                                                      Entropy (8bit):7.956417927660698
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:TfSd8DtTZBu2squcLPxtmC2OjVinln1qyfIw+HB3F5TWD76:L5/NlGOZiVfr+HJen6
                                                                                                                                                                                      MD5:A4A0F7723EA33D4DDB9720848D061F7C
                                                                                                                                                                                      SHA1:DE5AB146AE1A8EB09E0B698F27F7E8992303B3C8
                                                                                                                                                                                      SHA-256:C25077C72ED395A1752632F47B6A65D9BE564267DD388C852EDA513F26C480C7
                                                                                                                                                                                      SHA-512:F458B1C9D2D68BF70DFF9D542A999729DA4A1E41E3546E111A1F56FA0DA0F4ADB55AC942B25BE08683BF6D479B840388AB15BB6EF04DB511B770CAE23A789E19
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8X........?..?..VP8L.!../?...M(h.FZ........<jb>v..fF. ......W.`...CP..1..D..*r...W..H...r.~,...'ww....H....".....E..K..?.L..Av..{..(.L{..YiA.[.*6.i.....).2...^.=TB..F.#.fY./Go...}{.V>o.]...W.iR].....)..,........W.....<n..J....WU..n.i x .2............$.nq.@...o..hU.F........C..m;.....h.e_6.y]..n...m....$.I......y..mq........J&..4:.<....y......dff....LN..tb+.,...B..HM..8.'.........x.......p.=.{.?5../}......."[............N..RXNII...~.[...;...}..".B.Oim6>....S.?.;X.T.x....?......=..\..^..S.r....b.|...'...p......Nz..^...i..z..i9...@...T......a.|.[m...U..1....b4.+.=.!.x..U"..g.....3E...O!.r. |..X...@..GPDA..a.....|..CJ7p.....%$[..?....?.Y.a.#.thk3...kF?.nfS..v..z.....K=...b,.dwO..\(.|.-.q..2.........$..a].5..q5!!..R@..>Wn...d......>.5..SY.Lr..lY5,..y....._]..B3.H.75y...J..0.......h.'H.u..I.....VM..Et#.......@"H.ZDj....>.Iu=)5..|u.Y..x.S..}..& .5...e.*.s.3OU..uH...>.....%-M.>...P.0@.\...A0.(...A.W..._..f>O.0......^.d..j5..

                                                                                                                                                                                      Chrome Cache Entry: 387

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):78046
                                                                                                                                                                                      Entropy (8bit):7.988674618106342
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:x9oClSIDLCAl6g+8o0zWQjgsvs08QS8r7DUMBPxpn:7r93CAnNoM9dj8onTBPxl
                                                                                                                                                                                      MD5:D2E678F6A1758EF7B9C61546B03EB58B
                                                                                                                                                                                      SHA1:F3FC0B1E9AB9C106F114FF8A5264DCD6B597BCB6
                                                                                                                                                                                      SHA-256:0E5879615BA303E37B003E976B5891402CB2EC1A0F8FEA1A3AF2C318DE71E245
                                                                                                                                                                                      SHA-512:F5A00004621BE889217DA51B14E3705F799575F3DB9E46B2CFC574960FE686D93B70D8825BA95CB0E85260D438D7142A294B5307C8107CDAD7B32F44ADA2A381
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFj~..WEBPVP8L]~../..?.M@l.F...=........5D....Q.<.H....d....la?...6.=z.]...aW.....~.v....ZUc1~m.=..(.d...g...;I..'...93.3.(I.#u......#%..........J.-I3.fV..+I)/3R{KZ.-.'u'9.>.j....Q.aS.V.................N....nc...$.F.9....G.:IZW..k.....Y9.II.^K..,}iut.. .\..}I..\.X.$Y...$'.....K..........G..7(......f..$...$9....JI$.UTU..5I+..._..`..(I.....ff.3-.].....$..`I.I:..s..Qk..]T.@....3...."I.l.(..h..U.x....%...]14M..:(...8t.B..1F\z.2m.U.......c.#..B...m.Q...B(.J3....7.w..QX<.....k...@.. dk..)R..eb.:...........-.....;`... UJ.W.n..Z....;s'.=..J.Z....].......@....!|...L...[.}.!.S..d.F:...x.(@....w.N........hrTs.....mP[[....H.... ._&01.....K._T....&..Q?.Nj.K..q.MDF..X.....g...OyOw;.f.$.6:.I..W.U.....]...Vu.....t...x...h...nU?....].^...6..#......vF.`......"...Pb..Y...j.C.C.PS........8.&......]..k%...+....6....6\..M.2.......8.V.......%*..+]4.3.V.6..W..|.o..ttv....>{..K...wS..J...:X.5..f..C..}.N....vW.......X."s.v.r...v.....w...].T.....J.Bj.7.....x.......%..](

                                                                                                                                                                                      Chrome Cache Entry: 388

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):8936
                                                                                                                                                                                      Entropy (8bit):7.956907587624483
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:/DjXNwZH5YtK57zpLJ2wNL9UTREmszGjxf/PnhGkK6/olOaf5mONWuH:/DbM5Yk7t0wNxUVjFnhY6agON1H
                                                                                                                                                                                      MD5:04F069E71A745C59E6F9923DB1F2E1AA
                                                                                                                                                                                      SHA1:24A6DF876079A5400BBE5A01B9D9B5EB466969E5
                                                                                                                                                                                      SHA-256:DABAC5AFD05F5138FD5936ACEA8160DE1A18EAE341CC8AA619F998399AB0475F
                                                                                                                                                                                      SHA-512:8CE535D1D167CC00088586BDE47DBAC44E02643A318030F559646A2CF2F46E8AD513EFED79814DC57B516D7F91A949B2D8096FB6EB44090D72E4137F2281FA33
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/Me-TJ4UkyAck0QEv6-I8sdlt6Zln8Ll0tY8-mTTYtjH4jn_GGx3bEw3FHKjcDP81eBo=s64-rw
                                                                                                                                                                                      Preview:RIFF."..WEBPVP8L."../?...M0l.6.........#"....}..F-...p...[.".]0L.H...r...B.K.:.F...|.c.".....G:...(.....k....P....g.hB.0...a}...[F..........\.._..Y,.~.`.6.3......W..R..M'.t.f.ps|.']I $j.6/...YV.-..F.....gX.~.c.m.!I..=OD..*.......h9...z_.m.m......m..Y....f..C./l..;.m..<K../.h....m...mL.S..L./.Iw..d..N..hm;.h.u]...BW..T;}.m.m.m.._.}]..V.HRI...m..m...>..oX.....P......c...g@..D.sFq..v..}k.Z!...P..@".@b.)...HB!..... ..U.5....u-...m.b .$........."....Ee..60..iT.5[d.......0..C3.....I.f9.<......t..f@...$..@...)...5.I..D%.."....Z6.[V....Z..<..e...~..l..B.B.5..t&.h..*H"K......+Q<...4\.....IAR.s.,...........aMs\....a6...<...GNI.....D.BL...U..k..D...QBh..P......"..E....h8`HJ0..P.".c..o..2.9.3\sH..`,.L.$..`.x.=...}.r..=......w8.l.....W.....W......1.A*. .....B......@. AR.......Hj.BhZP,.....A.LAP.@,...o...h.@m..p......Q..)da.QUPg........Ez.|3].\OOVO.......a..?pbm}.e.......l...D$.....3.0. ..4..H.]B%. .p._.(!I.&.E.._?..Q.5P..2L......@..%.R].;CO.......

                                                                                                                                                                                      Chrome Cache Entry: 389

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):11010
                                                                                                                                                                                      Entropy (8bit):7.847908168465599
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:SAt0XvYpn0529J+8GO8bIMJbDgZt3rbGTEmMQE/dBW3NMUtbF0:f+8G938ZRYI3KiEJ0
                                                                                                                                                                                      MD5:D80B3ED07283321397DE506D79E0EFCF
                                                                                                                                                                                      SHA1:3A09C0AA0C0AB693203D587EAEAEF2062C0212AC
                                                                                                                                                                                      SHA-256:EA7F2A0DABC5A5ADAF7043D385DC4EE6C64E64256307CEF4EF5FCCDC26E7F713
                                                                                                                                                                                      SHA-512:7022C5593CDBE82F73A9F1DDA5CFB4C51F03A5F30EDEE92B9F1F881A93C028AB28EC43A8D71913CEF2F0700A95DB292EBE8F0419278BCA4F7DE16705460F5233
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/qNvgdUZ91rA/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF....................................%.....'10-'--5=PB58K9--DaEKSV[][2AemdXlPY[W......./..0W=56WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW]......h....".......................................B........................!1.AQ.aq...."R..2B..b..r.S...#%345DT..................................).......................!1..AQ"2.a..q...............?............................................................................................................................................................}c....O.{.B.(...}c....|.....Z....O.{.@.|.../Z.k ...}c....O.{.Bj.k(...>........w.5N...K.>.....|....ju..j....w...>.....e.O..{.A...X.~..Q...x=G.......W........:....$.....[...-.k.....51.....N.{.A}.}c......t........=...{8.~...5c...|....%{_....5Z.9.M.r_.K...g.q..?..M..E.J_.Jq...4.......Y..TN.\@4{......X...]3...g.=..........`4.....'.'.=..4.....=...u.8.~.T.a...ju.w.......z.`...*}P.....:...i...C..>.w~....T;.A..x...S.;.B>.S.;.A.. m.]N.........i.....{.@.l....i.....j}P

                                                                                                                                                                                      Chrome Cache Entry: 390

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):14521
                                                                                                                                                                                      Entropy (8bit):7.8525415109461765
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:6aLLNbRieKueQDm9Eep0faWdHwBgjXJwRy:6aLHiLueQ5Wg7Jwy
                                                                                                                                                                                      MD5:AF3B657F0E50DE0A91216E8D29BBA192
                                                                                                                                                                                      SHA1:451933DF586C8616D80A7E5DF423EAF173011F3B
                                                                                                                                                                                      SHA-256:C7824F47A12CEDDF63A07314DDFDD56C0DF16FF0728A53AFE4FF4B0194B70DF8
                                                                                                                                                                                      SHA-512:0232C6831D29829052F9BEEE896743B1AAF58E8C3E90E076C0AC17533CDFB4612A05620E23966ABA24772A22BC23C3635522656B81CD91650B7B991D11F24748
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/L46PkGz3SqI/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF............................. %. .!% %%..(10-(-+5=PB58K9.-EaEKSV[\[2AemdXlPY[W......./..0WB7=WWWWXWW_WWWW_]WWWWXWWWWWWW]WWWWWW_]W]WWWWWWWWWW]WW......h....".......................................>........................!1AQ..."Raq....2..#B.....Sbr..$3...C...............................2..........................!Q1Aa"q..2....#B.3Rb..............?..........................................................................................................................................:.C..W.>.W.....B.FZ..9......._..._4:...S..O............*.hu..B.Dk....*.hu...U|.....N..>.X:.A..Y|....S./..S..O.....j......._5>....:...9`......Y|..V.S./.4*t5..r....o5>...@..._.B.C^.g(._.......}....Y|....z}..u~.[.O....+y..........W.......}....Y|....z}..u~.[.O....+y..........W.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._.......}..._.B.C^.g(._...............hT.k....~...Y|........h..k....~...Y|.......h..k....z...

                                                                                                                                                                                      Chrome Cache Entry: 391

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (8117)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):141508
                                                                                                                                                                                      Entropy (8bit):5.721104481077863
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:qx4nQ3RLiR0Cms8miAxrypVrCVNPNWY7a3b9483E/jh7:bnQ35GO6VNA483EB
                                                                                                                                                                                      MD5:E364F795240176A03C01B24E2BB6C7D8
                                                                                                                                                                                      SHA1:13A831757E3AFAC2590CBA963FF21179141ED262
                                                                                                                                                                                      SHA-256:5BF67AEA42369ED0078F677FEAA550B1BD9FBACED40FE85F14141DF5093C211D
                                                                                                                                                                                      SHA-512:2BB3AEA5DF5461E812D0E8D2C1D78B4FAC81630F02E107A63E97CB561810834ECA2B04DDC0B12096A570420EFEFBC63B771026CCAC7DA0F587F0DD3B10F031DD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".H1RBrd{max-width:500px}.UIeOBe{margin-top:30px;min-height:120px}.k2cXo{margin:0}.XWz5yd{margin-left:160px;padding:0 20px 20px}@media screen and (max-width:480px){.XWz5yd{margin-left:0;padding-left:0}}.iCVHHc{height:215px;text-align:center;width:160px}.FOYkDe{max-height:215px;max-width:160px}.Dtwbxf{font-size:28px}.Hv8szf{text-align:right}.rYrxJf,.rYrxJf:visited{color:#00838f;padding-left:3px}.F9JOfb{margin-right:3px}@media (max-height:fit-content48px){.ZDGq3b .VfPpkd-P5QLlc{max-height:calc(100% - 48px)}}@media (min-height:fit-content48px){.ZDGq3b .VfPpkd-P5QLlc{max-height:fit-content}}@media (-ms-high-contrast:active) and (min-height:fit-content48px),(-ms-high-contrast:none) and (min-height:fit-content48px){.ZDGq3b .VfPpkd-wzTsW{align-items:stretch;height:auto}}@media (max-width:528px){.ZDGq3b .VfPpkd-P5QLlc{max-width:calc(100vw - 48px)}}@media (min-width:528px){.ZDGq3b .VfPpkd-P5QLlc{max-width:480px}}.ZDGq3b .VfPpkd-P5QLlc{min-width:calc(100vw - 32px)}.ZDG

                                                                                                                                                                                      Chrome Cache Entry: 392

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):74176
                                                                                                                                                                                      Entropy (8bit):7.9956452812069765
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:1536:Gs0Bn7m1EWnnvkinvpFgcEvXdwgGkEHDotAuZnlOHghbh5tBOCYMj:kyVvkGhFgXvXygFQoNtkEh5uCR
                                                                                                                                                                                      MD5:92D639281E9F4208F083A85CA8CEDFC9
                                                                                                                                                                                      SHA1:7F0E13C4BF4EAA97E2964B425D95C639F9C9F244
                                                                                                                                                                                      SHA-256:4CF59358414C932FD436A5720B7C3E5B87E41C2A88C93CF76445374F8E639039
                                                                                                                                                                                      SHA-512:012C2FF6C60C48E847FA9FE0B67531801570612F0682C9D8D39A0FE046E1C4CA6C68B7D90297D7F46B5C0A95BCCA56E562240F8E0CD0D27E96D9061E042398DA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/LByrur1mTmPeNr0ljI-uAUcct1rzmTve5Esau1SwoAzjBXQUby6uHIfHbF9TAT51mgHm=s256-rw
                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8L.!../..?.M@.d.n3..x.#.....O.....y.?...".{v.[.$)3...~.s3....v.&.H."l.j.$.../.wOuf.[.b...ve~..D..Tu%...~..1...u.][.u.#.~. ...S_...4Ii..V}1..}..a....'.m...........J...km..)IyN.....t.]3G-i.;.G~.....:m.{...1s/$.....x.83c...b.3.}.......Y>..|..9.@@......... .~.E..zp......(.(@J>%]d.9.m..bg_...T2.FV..}8.L...~!O...Ng^..-(H.s..$.tw...."..9o......].....z...{....!....&Y....>.....s..-U..F..MO.3..<..Y.,!../B....!~...My..Um..i. ..&|..sg....Q.W...J..L.A.c.1...moZ.=...."...xx2.....\.'@B&..?..)J....B..........6..B@D...E..X.R...U..R4R<Z..9;.!...B."...:.<..]R.H$`..!.H..!.DB..........zW.I.J.z.)...'.......!...1.njS].....B.G..4.p.T.m..xJ..`....I=.|......f......^....O...K73....K,Q....O}4..r*p..7...P.w.s..!s...Q|..d......y>jw... ......X...9.gN.*...|..Q.v.N~......|.......dI7.Q..w.>d:l,......'.*8.P.X..J.Bz.|xs...)%.w.4..8....f.............n.u.,.s.p..r..S1....I9^..*V..`.,.d+....E{f=.U....JJ..m..e8..j..z\...X....k.../<..S........9.....\.J9.....a..e..... ...K.)

                                                                                                                                                                                      Chrome Cache Entry: 393

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):5898
                                                                                                                                                                                      Entropy (8bit):7.954651102582187
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:s3BY9a/eum1aA1nUaF8ux95cRA2IUUYQHqJwCJFXJ8Pw2WqGVBf68N1e2R3Za:sxYCs1aANUQ8uX5cRAUQMwiXJGw2Rl8y
                                                                                                                                                                                      MD5:3A2D978D845DF8BF55DC483C7ECF8388
                                                                                                                                                                                      SHA1:F97DA276B9697C91D5195AA5C8C50A6B62735519
                                                                                                                                                                                      SHA-256:C914C824D225BEDA3CA2182EA4C44C153752CB9BA6814C8E9F1499577ABDA8CE
                                                                                                                                                                                      SHA-512:0E37E2F254D3AF1794B6AE2986BBAC4CA82F20C5E6DCB4DA3595826ADDD549D5C286B26CE74CE68C9A7120D844DA6C85118288D5F408A25D8EAA5DAD4340B353
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/image_more_2.webp
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........)..W..ALPHM....g.&.!.U.1........;S......e.U$cXD..c./9.F...*..?..?..?..?..?...w.E2{$wE......VP8 .....o...**.X.>)..B..!.J$(.....p..q...bo..5.D.....r.K....k.....7......$...........W...w......`..}..$.g...'.7....~.?K?.. ...........3..._..~...?......K...........?...?..@................o.....?.l...G.7u........I..z..K...?....h...s...~..@...#.S.w.g...!............s......._.>..........O.g...._.?.}......_~.....?.........H_........O....?..........{.................O.g.os.....wR.vTTy...@>.Th..;u....`.Jd@.-..Z...}.?3.3..Mo.'....-:?e.".".....2d..,u.}.......d.O......eV.n=..`?.k...El...n.Jf...-.E6.|..#...w(Z.A-.l..S..ja.QQ......*<... ./W.....,.`@X..~.G...:....L:..T/.7....1.......QQ........A.A.9.....m@s...uj.T..%.......A..ky-...zAA5..?.m'.~..>!Q.f.@......bD.L.y...7P.....i9j^71s.^.a.}8s..2Ih....\]l.S... ....h.*o.7IZ.A-.l..Sk.o4.....u.....2mX"7..u.#..I..H..A.fod.#.a...E;.U0'.@I....Z{......-..G.!(.6.)..k<.......zi...Bvs.R...YF..i......6. C....c .

                                                                                                                                                                                      Chrome Cache Entry: 394

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4507
                                                                                                                                                                                      Entropy (8bit):7.8282473005519
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:8YR2MzjrS4AIlZ89VkBePnGImXOXHZOu2WgCaAjLWlbQ2V:Nf/r/AIlZMGePnGzXm5OnWgL8WCc
                                                                                                                                                                                      MD5:19167917AA41E5AFC5EF57D780B41680
                                                                                                                                                                                      SHA1:61B8EDC3FCFD65AD9A17F0E7F1EC4935A7FCD8B2
                                                                                                                                                                                      SHA-256:21DE8627205C15775F3C44CA5CF25F986D21825D7A91800B8F183A93F1953452
                                                                                                                                                                                      SHA-512:665277A8DFB644A537E661D89AE28BE56B35C98498F2DBFBED4BB6B305737CA1D1058C3A7E34EFB5F32F972C8EFEA049A970407FB4DD712E262AB5E479664F83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:30D31679A48411EAB05FA6B755E57B72" xmpMM:DocumentID="xmp.did:30D3167AA48411EAB05FA6B755E57B72"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30D31677A48411EAB05FA6B755E57B72" stRef:documentID="xmp.did:30D31678A48411EAB05FA6B755E57B72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx..]..T......93....@ ...(..PT.+!..Q...hUL$.Q0Qc%e<.c$...1.r..X"...T.R....XfwY......|.....;..;w...

                                                                                                                                                                                      Chrome Cache Entry: 395

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):23781
                                                                                                                                                                                      Entropy (8bit):5.23295264757458
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:YE7RAyt/smRdJgXdxFCkFmY883qF121O87aDvuB4Y4jkma0Udp6Giy6Io6uL6E5o:xRdMdxFLFmM7ci4jbaZ67y6Io6L86
                                                                                                                                                                                      MD5:EF93C686E0E2B7430912CA1D0C2766FE
                                                                                                                                                                                      SHA1:3CFC713E766163A331ACF4655FE9C7D97E278500
                                                                                                                                                                                      SHA-256:04870310E9D1E0849F6E63AB95481C977B75FD1DE9098C1CC471AF98C2FCA3D8
                                                                                                                                                                                      SHA-512:4304AC41235F794930B82E24C2E977F46F906D71ED295EDACD5F8396D0ED59B1C0B87A9EC8DFF466405A317D433F2E4A12165C226434ABA140DAD82B04F9C4AD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/bottom.svg
                                                                                                                                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="692" height="579" viewBox="0 0 692 579">. <defs>. <clipPath id="clip-path">. <circle id=".._1" data-name=".. 1" cx="36.068" cy="36.068" r="36.068" transform="translate(0 0)" fill="#a7c3ff"/>. </clipPath>. <clipPath id="clip-path-2">. <circle id=".._2" data-name=".. 2" cx="36.068" cy="36.068" r="36.068" transform="translate(0 0)" fill="#cbdbff"/>. </clipPath>. </defs>. <g id="bottom" transform="translate(-752 -241)">. <g id="._149" data-name=". 149" transform="translate(767.934 268.316)">. <ellipse id=".._3" data-name=".. 3" cx="83.655" cy="18.211" rx="83.655" ry="18.211" transform="translate(13.072 488.396)" fill="#c8daff"/>. <g id="._19" data-name=". 19" transform="translate(45.625 65.552)">. <g id="Big-Laptop1">. <path id="Path" d="M7218.1,3285.341H6809.389c-14.435,0-26.242,10.825-26.242,24.273v249.62c0,13.449,

                                                                                                                                                                                      Chrome Cache Entry: 396

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):10400
                                                                                                                                                                                      Entropy (8bit):7.950295650853193
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PdLaTWs1PrsSUYgo5esYVivV1fIn6HH/Dn6GJrMR+:VLeWsmS3go1YMvnUuT6qYR+
                                                                                                                                                                                      MD5:89F750A76B87925ADC2A571AD384CCCC
                                                                                                                                                                                      SHA1:29D96B133E9F843B338DF410BE4D8BB0E4D2E28E
                                                                                                                                                                                      SHA-256:901CCE97A33F05FCC89109F6DD14BD3F141DDDDD6CD669AA2E6E9CDA252FCB59
                                                                                                                                                                                      SHA-512:FF337093D3B563BEFF868BBA755C45C6A81ACD2BC276123DBFEB4C22B9D8DA62850CBFED2961A3D8A8B6CF2AF359BC5FCDA8A4E4E69FE25A6B2E1ED9963E63B0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...x...x.....9d6.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Fireworks CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DF5ABB86A4A211EAB05FA6B755E57B72" xmpMM:DocumentID="xmp.did:DF5ABB87A4A211EAB05FA6B755E57B72"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30D3167FA48411EAB05FA6B755E57B72" stRef:documentID="xmp.did:30D31680A48411EAB05FA6B755E57B72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....%.IDATx..}..\.y._.wO..."i.4..H...>...vx...}....8...b.1ILHb..g..~........<b.j..`.&.$$!.i4...uO..7..{....=.zDT:...

                                                                                                                                                                                      Chrome Cache Entry: 397

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14488
                                                                                                                                                                                      Entropy (8bit):7.877375184944868
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:i+nkZheKRIwrm/a48si3/C1UKkb/0XUTkxXqDB/8:i+nkZIK+wrm/mP0K0XWdN/8
                                                                                                                                                                                      MD5:4544570A922C51E96CB2F1BB67A0608E
                                                                                                                                                                                      SHA1:ED99AD69140AA35B702FFDC6E0AABB78F529E18D
                                                                                                                                                                                      SHA-256:B1A9CA2D487FBA3195C3B53218A97328A31C10F45686550704957A8913BABB87
                                                                                                                                                                                      SHA-512:A79079CF4B0E3FA0B91F61C0AF75DA7F0E947B09FB0CA9D7FC2ACDB5E2A98604B7AE78EBBAD6AF3DF95D8FA54EE970DA1D64770384A1A273311A81D7B5B13E20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF..............................%%..""%%%%..'10-'--5=PB58K9--DaEKSV[\[2AemdXlPY[W......./..0W?57WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................C.......................!..1AQ..Raq...."2B...Sbr..#3...Cs..4....c................................(........................!1.AQ"2a.....q............?........................................................................................................................................................................%...=..5.. %...=...X"._@...>... %...=].CK.@Z..Od.......7.ib..],......~A....o.l..t...::|c....d...........'.<.r..D..#.._..)....`7...G^.....z..T...|2......./..:?...9}..u.....I.s.?gFu........_yC.O.G..1.yC.O.Nk....5......1.yC.O.C.........7.................."?.....?.5...M.q.s t..V+.G.O.F.......S....n?.G:......m.k.m..g..q.7.U.O.m.K......<...S.y.#[3.M..Q..E.y. .c......YH..hy..5e..g...U8...9>.,....<...S.9.!.?....^z*...~Bt]N1......e /-.S.y. .c....... ].c...

                                                                                                                                                                                      Chrome Cache Entry: 398

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):49
                                                                                                                                                                                      Entropy (8bit):4.379417496911518
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:YGKAAGYFhLiRMl4n:YGKAloIRMl4n
                                                                                                                                                                                      MD5:2DF439D118EA79EB03897DF8F13E2332
                                                                                                                                                                                      SHA1:D72A92741A6A079E288395119ACA08E08EA13C1C
                                                                                                                                                                                      SHA-256:4D65AE7371FD9D4CB23F83609A49535925DE39E8C4A2D4C87CC295C30FDEED93
                                                                                                                                                                                      SHA-512:3F8840B914C99665948840618412B0E8BF80D7A271A3C83A4A8A361C5A5B8B73B6B792578FDCEC36EE33D0C04ACA3C2E360A6529C090EAE20D79D0C7930BEBA0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/app/api_v2/getActivityInfo?osType=web&activityType=1
                                                                                                                                                                                      Preview:{"code":0,"msg":"There is currently no activity"}

                                                                                                                                                                                      Chrome Cache Entry: 399

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):40692
                                                                                                                                                                                      Entropy (8bit):7.995022526542713
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:slf3K5qlwBM1bCgq/s31UfnLjvNNYhqRhEZGrK5add:6FcWbCgCscGqRh+GrKwd
                                                                                                                                                                                      MD5:97952ED4B06D4891FECE3D3C842062B6
                                                                                                                                                                                      SHA1:CFE809DEF314F3D3569FD24ABA48F00001678684
                                                                                                                                                                                      SHA-256:DBEC46F7F8D5F6A8C9F734ACEF8AC317D05270AA26174E2B875EB44A804C10D5
                                                                                                                                                                                      SHA-512:D40E0038A3F3DE00D59DAD8BC46FB400A2EE167E34EEF577EDD0AFE5A746837D7347EE4D2FA99A25BE60955E2C79FCC7CE9AB05AE0AF1F7D666CFB36EAE3786C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ....0....*..(.>m*.E."..;vL@..6.\...2.{.l...W.,..............e...>'.....g./.O.w........e.T......./...o..x....^............/.K...W...?....q=d.....1.u..........._....1..._.?.xK.........G.....}........3.w...?.y#.....>....S.c...../.{.x......}.._._......................g...|6?%.....W..............B......._.r...........g.......m.........+...G.......o7...Eo..h._.?J..-..%.4..Q*.;Y...Wgg.6.f..4Zu$....t.."..Rnsp.}....~..2.&....tF^2.).?6%..g.....7...D...j.g..G.....h..E..X.+....*'\.....}..&...D1..\.*....\..L.....5o>..u..V.....i{.^.........u...)B...!.hI'@M .]......{..uy..z'..3.{...E.u Y.].....=...[..GP.(.E..=.....32`7...V,.K..;..7.^!$PoXv.......K>....p.(......P?O.:..........r..8B0.0.o.pi..t.H.N.H..TX .9|......';[Wv.V...;....SRV~........m.....W..j.L1...&t.f.8..i.w.'.|.@....-......Xza,....3s.4..ykw..5.&.J.%.......(..qt..d....P.....[.vgX.#.2.....Hk.{...[...W=-.j.A.Y..'.q]..i.....u....sb.0...g.S.2-#..".+l.Ku\.VB.D.qb.E.2...@96.v.4.OQ...

                                                                                                                                                                                      Chrome Cache Entry: 400

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):40532
                                                                                                                                                                                      Entropy (8bit):7.995619656406213
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:k/huNy3xHHS61C7DLFLn2XP384ueY4QKf9roJ+nlwa+z7cz6Q5pmxuP8mh9:kgy3xnz1kpz2XP3yEN9nnSa+vW15oxuv
                                                                                                                                                                                      MD5:581F3D3D49460D70B7727752C3339F13
                                                                                                                                                                                      SHA1:C70220D89F25E1310C2180F280920414A94208B2
                                                                                                                                                                                      SHA-256:B1C9E778A9253BFEC9874245823B23EE8C5BC40D131FAB451F33920EB418E145
                                                                                                                                                                                      SHA-512:020FA8BCE423A980065B7FC72CC61183791FC8A472BFE6B5D077580D787050EBB030F98D6C456DEFE6B1F2CF7B23C76CFA487A1BF3290814EC6BF11C8A7E8C20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/7W6atvA-tvlwAV-X1ZIwwGT2QyNesl5ooJLVmCx7imzDXh-lqUvrrtqGAN5Fv7XpRDJW=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFL...WEBPVP8 @...p....*..(.>m*.E."!..X.....fm..#..(..\.r......|..O...~..........?................S...w.O.?R....._.s...|.........w......................K.G.G./.........?..g........i.#...........{......g.K.s..._.}..a.....?/...!.g...o..._..w..|{.Oyo....G._............z..7...../....z..3...?.?......s....._..&...............>B...u...?.O.?..n.......%...........mk~...9.T.......).g../..6{.!.[.."J.o..V.':0.N.{.*......ol.5.........g...y.../ .74..F...8,_.l...i..]hY..!.ky..Y6..9...F.;..e...7!n.?.........i....d...%g{1I^4...,..B.......^..G.l..2._.V...t...5.P.{..........U...K.... F..bG`.h.}l`.......:...p....9..w.V.p..]..........g..}U..I.N.b.w....l@.........j..0........Qq.W.vlG$...Q..... .]..[.+.....D.......0.....h8....#s?.n..F...0...;. L.......2-.x ..../xzY[..J..q.....(..oN.6..p.-....w......).)!i..P..a...F...{ :.XL.S......b=.VD......q.....}......P.|.)76.....:l...Z.+.\./...d.0..L.T......m..U.....v.o..<....KL..{.<..).X./u..f.V&v.]."Um..."s]9.T.....l..L...

                                                                                                                                                                                      Chrome Cache Entry: 401

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):40532
                                                                                                                                                                                      Entropy (8bit):7.995619656406213
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:k/huNy3xHHS61C7DLFLn2XP384ueY4QKf9roJ+nlwa+z7cz6Q5pmxuP8mh9:kgy3xnz1kpz2XP3yEN9nnSa+vW15oxuv
                                                                                                                                                                                      MD5:581F3D3D49460D70B7727752C3339F13
                                                                                                                                                                                      SHA1:C70220D89F25E1310C2180F280920414A94208B2
                                                                                                                                                                                      SHA-256:B1C9E778A9253BFEC9874245823B23EE8C5BC40D131FAB451F33920EB418E145
                                                                                                                                                                                      SHA-512:020FA8BCE423A980065B7FC72CC61183791FC8A472BFE6B5D077580D787050EBB030F98D6C456DEFE6B1F2CF7B23C76CFA487A1BF3290814EC6BF11C8A7E8C20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/8zHwzv7f9h32FG_EtTHMhoqdw5MPCZJXgm7_895KnexlYOJ5RUJa0KyLPZKnXqTECA=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFL...WEBPVP8 @...p....*..(.>m*.E."!..X.....fm..#..(..\.r......|..O...~..........?................S...w.O.?R....._.s...|.........w......................K.G.G./.........?..g........i.#...........{......g.K.s..._.}..a.....?/...!.g...o..._..w..|{.Oyo....G._............z..7...../....z..3...?.?......s....._..&...............>B...u...?.O.?..n.......%...........mk~...9.T.......).g../..6{.!.[.."J.o..V.':0.N.{.*......ol.5.........g...y.../ .74..F...8,_.l...i..]hY..!.ky..Y6..9...F.;..e...7!n.?.........i....d...%g{1I^4...,..B.......^..G.l..2._.V...t...5.P.{..........U...K.... F..bG`.h.}l`.......:...p....9..w.V.p..]..........g..}U..I.N.b.w....l@.........j..0........Qq.W.vlG$...Q..... .]..[.+.....D.......0.....h8....#s?.n..F...0...;. L.......2-.x ..../xzY[..J..q.....(..oN.6..p.-....w......).)!i..P..a...F...{ :.XL.S......b=.VD......q.....}......P.|.)76.....:l...Z.+.\./...d.0..L.T......m..U.....v.o..<....KL..{.<..).X./u..f.V&v.]."Um..."s]9.T.....l..L...

                                                                                                                                                                                      Chrome Cache Entry: 402

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1439
                                                                                                                                                                                      Entropy (8bit):7.366400051072136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:/oamZAnlD521IDX3m94+3mOtC0mx8cbiF7sK/JLmpUO9b3lo9n2sTWKercWljn+q:/obyoIF+3mOtC0mxE7f1eUo3SRHTccKP
                                                                                                                                                                                      MD5:7B11876073896E5C656E0B53EC8D57D0
                                                                                                                                                                                      SHA1:D7892EDE82AA15D09FE9D07AD8BF268EDCE004D7
                                                                                                                                                                                      SHA-256:77ACCA664CE8F08FCD44DB03E5738E57F2BE9713C2373AB83182F898937000B5
                                                                                                                                                                                      SHA-512:8FB4E6880206AED53D8A081807965BE989C422DF404F3426C8087C9B8082C23A571D2DD48B020EF1B99325D420A3F6254D64EFABC6E36F0238E4535BAF20FB33
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@............:PLTE....................................................................................................................................................................................................................................................................................................................................... .. .. .. .. ..!..!..!..!..!..!.."..#..%..%..*..,..,..9..9..<..>..@..B..C..E..K..N..W.._..b..c..e..r..t..x..y..|......................................................................................................................................&...QtRNS............ !"@BJKLMNOPRWY[\hijkwxz{...................................................bKGD...-.....IDAT.....C.q....)Or..H....NBD9.1......eo.;{e.............:E..2(..:......@69.z......,s...`....A...D.3.).."DQ.b.FT...M.p.T.O.ica...E.0..x4R.....]Ie8,+ ...!.L..aCU...a.h..@....(.....0.x.......f3.d..&.....a.FF..>.../......;8.../....t..+.r..d..k8`.2.X...j^B.@m4

                                                                                                                                                                                      Chrome Cache Entry: 403

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):61748
                                                                                                                                                                                      Entropy (8bit):7.989183763154298
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Vy35XrfooAdq5fzwLTM08K+H5rWlyRzcoMo:49fdX5fUU08KiY0dh
                                                                                                                                                                                      MD5:A538AA1A5C81C10119948446E522D703
                                                                                                                                                                                      SHA1:791658E4C5E7B65CE030F671D79E5DEF60FBC421
                                                                                                                                                                                      SHA-256:BA4CB75A6480511B005F33E6B0D8C6931DC3EE2001E4136F4A2F6AB4341A4720
                                                                                                                                                                                      SHA-512:EAB184503116A9B01BCA3D052A5FD60C94FCC985BD8AD34F8A4909B07A060D429CC607EAB72A22A0CDE74F745F44D436E5ADF91EE6D7A0B1A9D79C6AC7329628
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/OmRFgoSS-iZDwzkMpygYEjbBkpY-_fpE2CEiEgj2KG0yoj2DcP01fbGMutWEf8ip2tiv=s256-rw
                                                                                                                                                                                      Preview:RIFF,...WEBPVP8L .../..?.M@.$7l3.... .`IVJ.....?I)..?V.2.a?...}K.z........"."..D........to....iI....s.nE.....<>.......o...{....A..F.2.?......*.....%`<.......P.7....c.....|]...m....Z..o\...Yld|)rOU.g.......Y..2.....uy.4.o.x.q.E....D.A.0......nq#.....tC.H....\Oz..$O.q|.....F...`.TU..HA.....\.m...pe......h.mIU..+c..S93s.=#........L..-...,..M%f...$.JF....[@....8!A.....IVm[y....=.>........L..A.4.f..8k........t......z...f5.S....B.a$.......=m..j....%..^.....6R.e.W......,..YI.#&.......S...k~W.o.........v\..M.......w..........?.!.-.^e.j^].........G...=....?..#...1.7...R5.K..R.%l...........xx.>h. #`h.&UN...S.x..O{c- ...9...A.?..o._...T.d..UK.?..K...q......,..)..j.{..L}....?..3.G.....y.]..Pw..d.r.X.....)......p.|...&.D;...v(K..?.<6.mgZ3....5...<.........;..h...'.p...v...{.,5.-..v...<.......0.e.$..B..w.J.t...8.^S~..N.'.......=t8.o..c.y$....%...&..0,.....P.8..?k.f.......u.......s..........;..0%r....M'l...<....e.....a.....iXQ.J....J. }D......a.bEc}w...6

                                                                                                                                                                                      Chrome Cache Entry: 404

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):19756
                                                                                                                                                                                      Entropy (8bit):7.989522453302349
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:D3q4SFgwI1KV3D5t9dkkW7a4XtE4SWyg6EsNsnE3Au+XSDgB2nsvWBOo:D9kgsV7QL7a4x1ySGsiW5vWAo
                                                                                                                                                                                      MD5:F7F13D43A67E989C89EA473B3F00E1EF
                                                                                                                                                                                      SHA1:48F4CFC4294BE0C90A1244887846C4887E1C14BA
                                                                                                                                                                                      SHA-256:FBE94B2E39E1DD5177A34D2C30598C51996FAA0B2165F9D9E40B2A18FFA4BED8
                                                                                                                                                                                      SHA-512:90D97E0AC39B42B36F480CB0C27E83D80982E5282089E56561874E84B4F7686EEDFD740949880C94F23BDEC539F9CA397B5E9A009B742F375FA2E67E37949EB4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/mobile/mobile-slide-1.webp
                                                                                                                                                                                      Preview:RIFF$M..WEBPVP8 .M..Pc...*.. .>.D.K%..".S....gn..U...;.@.......>.\..G.29.wR.T.'._..>.?>.........K........~..p.\..~.{......{...W..ao...=.|..u.................b=..]....>..n.7....C.oR.~..o./i.......'./.o.}B?0.......n....;.....||....^.}......_.O.......e.........._.....U...../..........;..............?o?..Y4L,.&.M..&...D..ad.0.h.Y4L,.&.M..&...D..ad.0.h.Y4L,.&.M..&...]...x"qY.2.3^B.X..Z.q.38..3.........m......}.......~1..JoL,. D..>.f...P%7...m.....x@M.[.u'.....k"/G..y......E.'...<..P?..2....nTc.... .4...'.a6.ph0..#y*.0...YJ......*......L.v....2....v.J.K.#......y.B...D.N...xb..gz.C....l...H.c6.1....Lf.....m3....$!..a@.5p&.kA......G.L..."..._&.ZD...&.8..B.."P..f?....Z .6O.K_.<..{9u."n.r3..MQ1.."..-....x...r[,.i.j.>H.n.`|..b.Y..)....?....3].D..S..Y.A..+@....Y....U.",...E......9....e..)86.._cM=....$v.BY..WQ.H..Cl..GT.Y*'....'^.HI....r..`.g.o,.D1G.t$.9..C.`p.....l.X.'HE..K.J......D..5h.h.Y4L.0.h.Y4L,.&.M..'..&.M..&...D..d..D..ad.0.h.Y=..0....j...i..

                                                                                                                                                                                      Chrome Cache Entry: 405

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):244
                                                                                                                                                                                      Entropy (8bit):7.052798134603722
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:c3ZFl0RTz7vgmXhsKroc6rRnPj5P1e32/XGyw7njUvp:c32Tnoz9P432/unjq
                                                                                                                                                                                      MD5:81226FE56259FE6976BC69271844349A
                                                                                                                                                                                      SHA1:2798D1D805F0B48140FABF2A95A925C5CF240AA5
                                                                                                                                                                                      SHA-256:6CD9FDD3B8FDB2DF17D4D09FB17006C8EB39A3DF753D04D541472A4C8E708284
                                                                                                                                                                                      SHA-512:AF656EC82FC287D897A2C227DAF621F593A56FD333BAB0C7E5664A24736683480CB73CBF91515CEA777FD4B9EA309AD6B42EF261D835E8060FC98DA7BD65E3E0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../.....@.$.4P.k.,..V.r.d.+......7.....n..]...fU...ms..../b@_x.W..?)q.Rm.$.6.p.Q-....`..a..._B_.SB..dX.2.....5..97n6....;N...]..{....~.P.N[....j$.!.....$..`W.(q..r.7.G.....lM...........b,....$...aS...3j..A9..<9

                                                                                                                                                                                      Chrome Cache Entry: 406

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):14588
                                                                                                                                                                                      Entropy (8bit):7.964559576149324
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:mUJ6xOHV90/Zs4xCbp66lClUi7snEYCKtx:JJ6xO190/NxCbsNqikaE
                                                                                                                                                                                      MD5:A5C6E9A7E02C954C0632FF808377022A
                                                                                                                                                                                      SHA1:CCB6EE20076CD565F7741707A0DEDAF69410F50E
                                                                                                                                                                                      SHA-256:9F974F65DF6B98CED053C78DC4D7A8A8FE86B8429C4603256B9A2712B079A953
                                                                                                                                                                                      SHA-512:3463DBF4DF5512F7F0C4D66144BCEB612C6BB64BBAEF8F36BF1950D57A7327AB151122D881F462FE10AB34F1B78B3A151460E616C69B8AA44CCC60E2E9236AF2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/TpDGU2gKqhZmbyNUycCU1ehNVdBO-DJRe0mMGuzkGAStevtteUd6tmunIRFPENkoyJqv=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF.8..WEBPVP8X...........'..VP8L.8../..I.M8l.F.F.....d./ ....W...C^....k..j.^...S........7.&.}%...%......J.y.....M.Z......T.!....j..s6...l.}.Af'l.I.C.....\yx....V.(..3...{>...I.#'.-8.....<.......2p..k.....h......^....l......(....C......O..u);.H.Vj].[....~.N...U.sv.J.T.r=......e. l....\o.....N...\..\....V.&.n.n.c....u)........Q.@.....d+[.J.G9..ZYS.EQ.!.3UY.-.N..f..t.N.E.{...`R.$....J-.sC..?F.x..?&0......F.*F|x...v~.q+U..L....@U<..ZrZ...t.'.n......L+..h.+.;0.$4.2..).`......!............l.Q..p.2.....l.[...@....*..m#I.D..........wFB.........*..x7{^|.Oj..Y...7>s....>...yr.+.\..Rp...IG[%s.l|../..ff.gf>..!....eff.0333s..c.....t>.......r.Q.z..[%mo.....v+.V.X.7.H?+.H.l3n-.\.L.._..Z.F...ne..S...X..p...........$O....*]eK..Zb$.........?..@.....H..I.Zv..............l../r....Cb.eV.q...........!....N.S.k..A.%....._.XZM|....c......YU..W...,.N..S-..f9...2...u.*.j..T.|.G..X..%o...n.|:.e..Zk.m..$.}.}.....HD.m.m._m.YV...i;......g....6...8..A.+.j...m#k........"

                                                                                                                                                                                      Chrome Cache Entry: 407

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):17514
                                                                                                                                                                                      Entropy (8bit):7.934390195240858
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:WYC8MQOhpYh7rEJH53y02BwaCLVpX4vqvZtB58IvHi:IbQLdrkBeBwppXbZtBxvC
                                                                                                                                                                                      MD5:8EDAA6B2ED06CF3495C8FE9A91380CE2
                                                                                                                                                                                      SHA1:77B0CA25329DA84E78EF02002A30F960DC52F8AC
                                                                                                                                                                                      SHA-256:2AF63F6B0733B0CFB11BD31D2F761C93731D82F614338869BAE39393C2D28106
                                                                                                                                                                                      SHA-512:CBCF94DD8A6D5C04945E2486AF782C5F20EC0190763EF231D0FA3ADF6C0D2396548D2198D64EE763A916D00F32EFCBE1C4A6E5D5FB63F2CE5FB57BC4111F4AB5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/PvkzJmGSbdASVw9ixYayMB1K67U8N4zyPtfHR0yPxiDPj9Dj8CkqbZvivlA39qqUBMw=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFbD..WEBPVP8X...........'..VP8L.D../..I.M@h$..Y}>.?...".?.....LYUZU.o~>....I.T.R....]g..X...*.$.l..<.A........3..Y.....t.....$...$.....n...[w'g(..)U..L..@"D.K^.$.A......t..nw....8e..,$.., G..I.4..[..O....A....nl..5.RtC<7..JT...pF.d0.$.MW3....{R.N.m................!2...t...p....bP...kR$...cP....8D..Q.L;I.....P........e.....(.....}...]f<.H...c...........]....Yih<*....XKw..0lN..d=.G.g..k...p..?....w......e..(. ..'.......o..3....$kP..C.......I.....A.D.+.8..DKR.&.[.`"p.....oQ.H#....E....@.{.#...6.. ...2...XQ+...z.(.bsu|nu.O..A........!6...uH.n...6.$I...Qww... "&...a`@g......=...x.E..w....H.T.....^.|.z...#Z...#~.R..GY>........!.7.PA..q..q..P..v.".......Y..+..z.`.JGf....V3...lm."I.m...Y..%T.dffffj1\@..c.g.n`2_B13333&g....PU.q.0..7=...d[....3.)bz.,..EM.R.....:.8...nl..d.....,.X.G...>..........b.|........ka..i.....F...m..m.*....v..d&...^... 3k....s`..c{..z..v...m.m.#.s..vd..f......S.m.mY..~....g0... ..p...(A........s.1....W.F..s...Z..m6.

                                                                                                                                                                                      Chrome Cache Entry: 408

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):645
                                                                                                                                                                                      Entropy (8bit):7.631563068517978
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7ihaL0Z6T2rkLv0cLSbLzKlRv+reS0TZPhnv8NuKS8jrRJI1b3g0hfue9:riS+v05bLzK7CmTRhnUTJjk1b3Jhfj
                                                                                                                                                                                      MD5:EA2722D3B676D5CDD4F7225E65695112
                                                                                                                                                                                      SHA1:97E5E94CFF5B62F60BA76C7DD9F606304AF8B10C
                                                                                                                                                                                      SHA-256:317E5FDAA14E548C0045D5E662709CFE0B692E0384A8396CF22054BF0A1E1C48
                                                                                                                                                                                      SHA-512:BF06CE48B306A0EA13EBC7BE92CB56440DDF1C35C214BA7C164DECFDA6E2E7AAAB31605196D0690BE4FF509404701CA620C504A5EDF0C3E6A12C6FA5A73C78DA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://fonts.gstatic.com/s/i/productlogos/avatar_anonymous/v4/web-32dp/logo_avatar_anonymous_color_1x_web_32dp.png
                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....szz....LIDATx.b .<|...P|.h(.E.0.....|.x.......a.....!.....q{.t.U...(.A.g.....w.3,&.s.~..h2.....Ip=..4!..[.................r.p6.R......R.....19]z.......%.E.q..........6".#...9..Y.n.U.ZU.ZMu:.Q:t%..y`<.+.0T6.=.i.0.e..a.f...b.\..Ax..e...K...$7..BAk@.\f..}bG.K....\Nk@.T.ha.+.w.%x.5.....k..OJr...$Gd....,.0....n.{..b........%].....K.....?....f....w....j4...@%p{?...|>.....hH.h.....r....h..s.J..@X.j..3#h>.`@Xw..l.K.;).c..>....V.b. T....0B.4....%G......a[..P.........G..B"..!*...m9rj%.....E.AD*...0...!..y``....o.z...1J.FF,..sEr3.s.&....b.m.+.........'.m3(D..{..:..So.Ja..*......#..'....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 409

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1384
                                                                                                                                                                                      Entropy (8bit):7.132187656560753
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:hffamZAnlD521IDX3mVIiWq6wYeN1/meriF7sK/ZkioRQnAIurCdUxgz4f95Xy8E:5fbyoIoIiWq6rOc7fFQedUxg01Fy59
                                                                                                                                                                                      MD5:5B0A0B21D5BBB147049D8C1E5D0E36B3
                                                                                                                                                                                      SHA1:4657B6FFEAF84B964F2F032E15D927F2D5F02777
                                                                                                                                                                                      SHA-256:CDF696361687ADB4CD8B0C7501ED6093721961E7A7E0BEB5304FEE812C947BFC
                                                                                                                                                                                      SHA-512:DA431DBCE84354E66A87080432823C739848B5B9948B89D31630693BD0354CF9A9B8AD1C1377F0AF735389EB66F4569497DA46E585A72094558A52683143E7D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@.............PLTE........................................................................................................................................................................................................................................................."..#..$..%..&..)..)...../..2..2..3..4..4..5..7..7..8..;..<..=..@..P..U..[..`..g..j..o..v..w..{..~............................................................................................................................................................................................k...QtRNS............ !"@BJKLMNOPRWY[\hijkwxz{...................................................bKGD...-.....IDATX.c`.................;...Ul.7 .?[e..u3.Z.l....".............h..`.KH......G..v.....&.n.l......8c.n.Q.....M6..LY.....h..M.........!..o....7.......U>q...0Z...k@v....#......V..]T...K..hK..!h.R~.`.W......|.D2@........RB2.K&X_...Y...^7o.....r...t}Tppph1.....u1..?DI+..sr..{..{...g`Q..7@....D...w..@.n.:.Pj....._

                                                                                                                                                                                      Chrome Cache Entry: 410

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2144
                                                                                                                                                                                      Entropy (8bit):5.26370623880831
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:kSTRM3pR4ARI5PARBBRRgwRNG4pRk6RBbRjRRlO0RJc/dRpPMRVkrl:k+Mv4iI5KB3R/NGqkgB1jHlVJc/jpmVm
                                                                                                                                                                                      MD5:56A09334C967D2F034070EC04E58F5DC
                                                                                                                                                                                      SHA1:DB800A7FCA2C85B5607FD787232A5430A38AEA2F
                                                                                                                                                                                      SHA-256:CF6288044358D28983C58304B724156ECD5500700F85289178A87E0D1B598B2D
                                                                                                                                                                                      SHA-512:CFA53C3E7CBF64A237DAD39C53464248DD3950235D2C91E86C01A364B3B9AB9E234719A1314191144033C0B30CBE44FE3693E892892BD3C46687EFC3E83A1CAC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("CR2XMb");._.pr(_.eEa,class extends _.qr{constructor(a){super(a.ua)}H(){return"CR2XMb"}O(){return!0}Ya(){return _.B3}});_.Zq.CR2XMb=_.rC;._.w();._.u("nQqY4c");._.pr(_.jEa,class extends _.qr{constructor(a){super(a.ua)}H(){return"nQqY4c"}O(){return!0}Ya(){return _.Njc}});_.Zq.nQqY4c=_.eTa;.._.w();._.u("baVq7b");._.pr(_.UBa,class extends _.qr{constructor(a){super(a.ua)}H(){return"baVq7b"}O(){return!0}Ya(){return _.JVc}});_.Zq.baVq7b=_.KSa;.._.w();._.u("zbKb5e");._.pr(_.ODa,class extends _.qr{constructor(a){super(a.ua)}H(){return"zbKb5e"}O(){return!0}Ya(){return _.ZJb}});_.Zq.zbKb5e=_.XSa;._.w();._.u("JiSSTb");._.pr(_.lAa,class extends _.qr{constructor(a){super(a.ua)}H(){return"JiSSTb"}O(){return!0}Ya(){return _.WBc}});_.Zq.JiSSTb=_.hQa;._.w();._.u("Grlxwe");._.pr(_.xAa,class extends _.qr{constructor(a){super(a.ua)}H(){return"Grlxwe"}O(){return!0}Ya(){return _.QDc}});_.Zq.Grlxwe=_.rQa;

                                                                                                                                                                                      Chrome Cache Entry: 411

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6728
                                                                                                                                                                                      Entropy (8bit):7.956249658897854
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:tXfv2Eo7fXfGGnrgG/kZPnpvs/zh6gH8zS:tPebHAGsPpvs/PH3
                                                                                                                                                                                      MD5:4A87B23725F9EC28FA4CBC7EB63637D6
                                                                                                                                                                                      SHA1:7EA800E51FAD2724ACE0C9AAE4DA4E20B3E01154
                                                                                                                                                                                      SHA-256:ED57B68A94FBF6070E9E02C8CF7E77CC4DC7A99238C0F09DA6D787F9DA1A6C1A
                                                                                                                                                                                      SHA-512:D8DFB68630291C04F67F9EDD2C632E0AFE2FCDAF8D4971034B48FB849C714469580823D7857FA2F633F7DBEE3B4C1AB5D54E98A144E19DC4C5F94A3A1BF41A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...x...x.....9d6.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.01/23/18...)....IDATx..]y..G}..g....:....[...16..I,l....N..@q...EH..U!.RI.J.*..J%.......X`.@$,..m..l.@F.n....o.1G..{........}o....~W...#.1.q...u..XX..>.a..)>Q.....-O".{....y.2.>xx......+.?\-.v.i^6...MFz..5..2ogZ...dxn...N.=1`../.4.y...S+.....u.s'x...?..e...D.c5..M........2.......E..x........_u..X........zh.v_y.S.].82S....I.J.....#p...)...Q.......\...a.=...............7.v.5`...m.........p...:..#...7l...3K.?W.....e.p.N.6.....M.b...........>....d....3.....[v....RX.m...M..d0.jl..7..}......F.......].......]......s../m....M.[..01.D..?.j.......!..@....W....8..u..$..w|..w.........(...;.Vl..s.=...rj...o.~.....:...9.A.j...C.n....~*.l.._.=|r.....*.(R./..C.|jz.w.......n......-.-L..8g......t~...|.co.Te4.....X...l..ws.J....v...{....,.J.........B....E...TWi......=.9_I..c]..k...j.. .#M..N.mC........c.Gk..9mn.....T;...^.K.

                                                                                                                                                                                      Chrome Cache Entry: 412

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):164
                                                                                                                                                                                      Entropy (8bit):6.560027690474973
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:u1Zrql17vRGlYo0Dr9TpkNTF3N9aQgn+39IzWIkYutRCv3hCEKX/n:u1Z+l17vRGMhuRT9p3WzWeutkvRCEKvn
                                                                                                                                                                                      MD5:C3D7960132B3DA262B721E88CFB2583F
                                                                                                                                                                                      SHA1:1612089211858694E09F6F715F3A0B4145DBA674
                                                                                                                                                                                      SHA-256:DE88165FA4D58B4AD531B6F8D8FACBC5DC00F73E96B617E503D36FEE29C53CEC
                                                                                                                                                                                      SHA-512:F18E3F59F71CF7521938C90826FDC28BB7F3EF43749C4DBC48F46FD6FA1B293A58461B50E021B7569F4EDD55B5129C4755E61E3D4F1205B7535F5A572A6EBE45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/ohRyQRA9rNfhp7xLW0MtW1soD8SEX45Oec7MyH3FaxtukWUG_6GKVpvh3JiugzryLi7Bia02HPw=s20-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../.......$)...M.=.X.~..Qm.J.....@.Z.......{...m.FiS...`..V..l&Z*. "...V..(..N......c..eLp..@..+..$..;.3......D.&a;|...H..R|;..3..#XD..UR..>V..

                                                                                                                                                                                      Chrome Cache Entry: 413

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (712)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):19661
                                                                                                                                                                                      Entropy (8bit):5.724805524341729
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:gzoIG+JO4gaKWY7nrl8JwmfCjlrE6tAbuiFAgpLK4x+Dse4zDp9EFT8xK/qHZ6bu:mS6KWY7OJwmfCprE6tAbu4VpR+DgfjgW
                                                                                                                                                                                      MD5:F0D207AC51A0977CE569C3CF2BE2AAF6
                                                                                                                                                                                      SHA1:910ADBDCB9BE52CA5878FEE48EA3AC28A3CD7FE7
                                                                                                                                                                                      SHA-256:C555D37D2850FDED128053EC20B3A2FEE47AEA9DA5E4999BAF7C876B9FCCFC0B
                                                                                                                                                                                      SHA-512:09FA91D8293AD0A0F9EFF503111DF5AA1C94E9A3E9A6E92EF377DA37FB12D83A111EDB701DD7F4F14FAF4AB3EFAD6F6C0898E1D4AF548D2E11506551B6A58A83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".N4FjMb{padding-top:40px}.yb6DRb .N4FjMb{padding:15px}.jXRZQb{margin-left:24px;margin-right:24px}@media screen and (min-width:600px){.jXRZQb{margin-left:48px;margin-right:48px}}@media screen and (min-width:1280px){.jXRZQb{margin-left:72px;margin-right:72px}}@media screen and (min-width:1440px){.jXRZQb{margin-left:auto;margin-right:auto;max-width:1296px}}sentinel{}");.this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.bv.prototype.H=_.r(251,function(){return _.L(this,1)});.var OTc,PTc,QTc;_.MTc=function(a,b,c){var d=(0,_.P)(""+_.uO("info_outline"));var e=e===void 0?!1:e;let f="";c="LjDxcd XhPA0b LQeN7"+(c?" "+c:"");var g=_.R()?_.Uo(_.To()):"";g=(0,_.Io)(g);f+=_.rO(a,b,c,void 0,void 0,void 0,d,!0,void 0,g,void 0,1,e);a=(0,_.P)(f);return(0,_.P)(""+a)};._.NTc=function(a){var b=_.P;a='<div class="'+_.T("kk2r5b")+'"><div class="'+_.T("edaMIf")+'">'+(a!=null?'<div class="'+_.T("bGJWSe")+'">'+_.Q(a)+"</div>":"");return b(a+"</

                                                                                                                                                                                      Chrome Cache Entry: 414

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):34736
                                                                                                                                                                                      Entropy (8bit):7.994831968088191
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:03n7+TtVLG50DX3C0/P+0/hCstO05hP4qK65YgFrXLfBBUmBo:037MeKX3n+8g05VsDgFrXLfwoo
                                                                                                                                                                                      MD5:9F6E8DDF058E07392417009FB91BB655
                                                                                                                                                                                      SHA1:B97A6FD4756779522EE7E1098276478E8EC29E3B
                                                                                                                                                                                      SHA-256:E8ECF31ECAA90B199C1785ABF0FC22B6582081378CB23BF5BB3CEE5C4357866A
                                                                                                                                                                                      SHA-512:8FC862162CA1FD8531B4D8CE4DC22346DED71B13A75B3AA44BC2ADE88AE90A2E18954AD99EC383AC49B411E4B3233803FECE2C8C6941DD35D85502901D7B67A2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/fWTMnVjgBAfjCInJ96h4iDkRQk5elY0RqNT1LJmQ5Pqoc8UxYK3lsl5L63yFPnW52u94=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*..(.>](.E....+.;p...di....a...~.Y+.i..?3=.../.~...........n=5........^.Z.....m.........c...'.........?..j............{.G.k..?.?..............?..g....._._7.....~p...?....T.....S.'....U..w....z../._..5...........<?{.S....././...........`?..........u.....?......k........^o...?t?.......?.b...a....LAs....a.ed.. ..9.[x+qt..#...MP..4X.M.L.`\{.vs..........dz.2.Sq.......L..).ciu....Q..b....L."{...4.j..[Rx...d.6...H....^....n..$*=..f~..(].s.....h.[......J...#...Ro...t..-@....D..c.N+3.....L..@.b..R.aP..b}..]C.yZ..6C".......]3...)YJM..L.q.|..ydc.'.....f.o+1F2...m\hS@.r.j...`n.Ou.V.. d.o.x.vfLht....5H....;6..1.7.xy0.;>...B._VB...K.}W[..*=.d.Z.......W..&...p.+...'.7. ...9S+5.G.....j....T..o....@.CY.-...".....~u...7........^....Ig.......u.....SF[....B..p=w...1]..\7c.......j..>....(.TL........A{...f.;...a..D9..i}.. ..&.1.iCS=Z...+9...X....c4L.....0....0.y.F........&..rN..Q4...F*...)Sl..N.d...!@........p.....F..X..S.x....s..}...$..`

                                                                                                                                                                                      Chrome Cache Entry: 415

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2524
                                                                                                                                                                                      Entropy (8bit):7.874311886017005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:MyjhfIkszJiDh5u2k1fscvEoih8ubjtFYvOguRNnLv8dM75wu0PQ:nj9IkIJ29ifih8EtFYWgEIM75ht
                                                                                                                                                                                      MD5:D1B31F406A40F61AD7BCE8D04DAA0DDB
                                                                                                                                                                                      SHA1:C019BC02ECEF4C51F3F35EDD74F67B60F05793CA
                                                                                                                                                                                      SHA-256:47124FC3E5D9443C21C387167A58F402C38791761183013F568426401345340E
                                                                                                                                                                                      SHA-512:31C7EE003B7915B0002E3621079F5FFABBD8D02CBE96F446303A7F9A4DF7020CF778ACED1BD125A9383A47D9415B0C51E934CA435DBA563062679449DA50E1C5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/Q2SnHYvZ1D7geom2mK0CDAz4TUZkm8saCEBSsk3NHvjGyJKk40uwxac6zpuZpXoqgw=s64-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........?..?..VP8L..../?.......m..?.v.BDL..b..`Z...?m....`.2CR...de.08vRX,....1..X8f.1....J/.3../.....fffH.4sw.0...f..-.a.6.Dy......F..I.....0....1.r.m;?.......TS..r.`.`...Y9.m'...B..T.2.......'oN*8...{~.ve.....m;.@&...U.J..6*.p.F."...33........R..JR...6D.....*%.QV_V.....\.a...bs.)...j....h...H7...*..}...6D.........vb<.,zW....o...8..|S...8<...%..`)'C....|._..cC.*{.'x.ER...$B$=c0.8..%.)y.$AI..+O....J38.SLU7.....9O.bffD>e....>.......f.!X...XD.f.Cy...."1....u.E..7..s0>.....xh..R..RxN..NT.`XOq.>....7..-. .....N.....=|0..W....UW.K.... .K..:e.....2P#..lT.&.X..\..|`..t....3.....X.9y.._`n.z...b.Xo...X@.(_D.!9..KD._..D..H7.XJu..#...-.r..d@R..........X.'...|{.%.9C.d..-....9x........d.C.......9'.{....O9.Qv..u............"+++...U..o..fu.\.22.3gH.RX........t.9..&.H.l.:...s0..$......f.....5........2.4.xIx........E..T".o'...O)..4.`Z0....2....pZ\4..5.............k........cL..OX.d<...0c.auV._6..4jmY3....[.UfW.X2......P_.5`GMy/.&Q.k...

                                                                                                                                                                                      Chrome Cache Entry: 416

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):37652
                                                                                                                                                                                      Entropy (8bit):7.974148108955924
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:Qq8Z5qjiJHYdijkie+xJFCCQA2oHW7UtUI3/JWFp43tPt4V+L3+H:KCiwie+nFHquqI3hgpkCML3+H
                                                                                                                                                                                      MD5:D6BFE3DF13973B305DA1D021B1E5988F
                                                                                                                                                                                      SHA1:A73D7391BC11B81C4526211A554DDAB04376CDB3
                                                                                                                                                                                      SHA-256:2E9CB798FEB5AFEC38D5C84B02FD246883761C8F7961E26F361EE31C2C425C99
                                                                                                                                                                                      SHA-512:D03F9DBE4A45CE437B31A252CE7CA48727993A6A8D46E03A8FB1C286AC0D67D871AC888BDC17D9D9833E417BF07710710DA1E7DAFE3EB84AA8AB312D49939DCE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/kqxAy363Pag/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF......................................................................................................................................................h....".........................................T........................!.1..."AQa.2q.#R......Bb...3r.....$S....Ts....4CDd..%c....................................7........................!1.AQaq......"...2.#.R..3BC..............?...Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P...8.......8.........N$z.4S...._...-.......i.R8..4.N.._.~..Z...._....Xu.X..h.o./.i.Z..'._...-8..8..5QN.......k-...~....qc.$z.TR.a>c..+h.s.......tS..w...y`.....~..Ww........`g'.v...T.H.^Lg.........v....r0.#.....).]E...$.$.O~].m..... .W..3.j.5T..EYE].?&k.8.Y.3.......f.+...I#...8...Z./.....$G.].........8...[...JP>G.O.k....s.R._....##<.EzG..c^).......:.~G.O8..........

                                                                                                                                                                                      Chrome Cache Entry: 417

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1180
                                                                                                                                                                                      Entropy (8bit):6.526235225312809
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:F1hmYaWwjx82lY2T3QvV2DwbyJ3Vj1GMUyeWIPehC0:rMYLNn2Mvp2J3D//zIPehC0
                                                                                                                                                                                      MD5:B78A81594CF27BD6A7502BE72A9936B2
                                                                                                                                                                                      SHA1:5728D813A3BEB53686119DFC57A326F23D231FAE
                                                                                                                                                                                      SHA-256:70C8F4D1883346B5484129FE4D03042C71FC1228D91B64870EED3D2CD5EA1E48
                                                                                                                                                                                      SHA-512:BD3DE8165E8084A550F422C888250A385801202C3F0D5B2E4962A4BF358656ED14C74F33FCA02F77206DDB674E3B91F082EC090E513C586A595E35B0BF6C6F21
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/download-more-icon3.png
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:3C280703A22411EABE3FA987F0B8798B" xmpMM:DocumentID="xmp.did:3C280704A22411EABE3FA987F0B8798B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3C280701A22411EABE3FA987F0B8798B" stRef:documentID="xmp.did:3C280702A22411EABE3FA987F0B8798B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.=......IDATx..=..@..3......[...D.%k.BD....<...Y..u`...l.#..!o..f..m.g!!.}.9j.......P.7.(r.uy.`.X.?{<.......vM.

                                                                                                                                                                                      Chrome Cache Entry: 418

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1477
                                                                                                                                                                                      Entropy (8bit):7.3071949812052
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:CatFK2bRVfnqbCwDX39HXjpEGgG59N7WGH2HtqMVpNz/QBzBMVSyKuIy8hDRi2DM:Cgw2HqbDdyq5Ww2RVpNz/edySHuIrDkv
                                                                                                                                                                                      MD5:658F40D68D6BFB60F43B721EBDF6EE21
                                                                                                                                                                                      SHA1:71DCDE26D5D302CE3E1CB147991C0A0FB24FA59F
                                                                                                                                                                                      SHA-256:7EC5D8D5893E23A0FA625C54D91B59DD7873855313B8440894BE6E728A54B4ED
                                                                                                                                                                                      SHA-512:1CC8D4CBAD17AE9D36159E0C41F71DADB583171BB9629232FBB3F26C288473869D35113FD13B085D2B5386961FC0110D4B59FAB54B6D40B05BF8457E3681B70B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@............@PLTE...........................................................................................................................................................................................................................................................................................................................................................................!..%..'..+.....3..7..:..?..?..A..C..C..E..H..I..I..J..K..M..M..M..R..S..V..W..Y..Z.._..a..c..d..e..i..i..j..k..p..q..y...............................................................................................^.7....dtRNS...............!"#$0145PQRSTUVXY]^_bdfoqrt|}~...............................................................bKGD...-.....IDATX..._.A..g.45.S....CMA+.;...KJm........;..O*........E..y.f..G>.}>...;...,caU.....q.;..YH.c.\>...e.cM.0-. .Li....L.S.. .Mn.q.g..........m..5.(.r..|..N.C...`..'..\..g.S.c....b&.......:...b.Ts..4..)...N.....*...G.....&.....E...t.@r...

                                                                                                                                                                                      Chrome Cache Entry: 419

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):11607
                                                                                                                                                                                      Entropy (8bit):4.956944254055404
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:MtBYNTeJeYSUihIZeBqQt6zTGxsxxxqLexPx9LxGNVgCggVrJVrhKqmWU7j:Mv+Te86uxsxxxqLexPx9LxGNfVmWs
                                                                                                                                                                                      MD5:1CE09D402B4C3AEE84ED6299F793CD21
                                                                                                                                                                                      SHA1:5763BD1A8015774F37215359BFCB5EDD65D198A6
                                                                                                                                                                                      SHA-256:734B9C920CA443DBF993E22A56264E64A738EC99FB2908A5E3F30FDF2480DC5F
                                                                                                                                                                                      SHA-512:43049F6575F6C3D4835923412A9128B3AEF72D76A34C9A582B0B46FB324D3FDCC7B2046B5AD352C7580A57207AA9650FE302741DF9E4F4A273AC1E882AB5E611
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/photoswipe/default-skin.css
                                                                                                                                                                                      Preview:/*! PhotoSwipe Default UI CSS by Dmitry Semenov | photoswipe.com | MIT license */./*...Contents:...1. Buttons..2. Share modal and links..3. Index indicator ("1 of X" counter)..4. Caption..5. Loading indicator..6. Additional styles (root element, top bar, idle state, hidden state, etc.)..*/./*....1. Buttons.. */./* <button> css reset */..pswp__button {. width: 44px;. height: 44px;. position: relative;. background: none;. cursor: pointer;. overflow: visible;. -webkit-appearance: none;. display: block;. border: 0;. padding: 0;. margin: 0;. float: right;. opacity: 0.75;. -webkit-transition: opacity 0.2s;. transition: opacity 0.2s;. -webkit-box-shadow: none;. box-shadow: none; }. .pswp__button:focus, .pswp__button:hover {. opacity: 1; }. .pswp__button:active {. outline: none;. opacity: 0.9; }. .pswp__button::-moz-focus-inner {. padding: 0;. border: 0; }../* pswp__ui--over-close class it added when mouse is over element that should close gal

                                                                                                                                                                                      Chrome Cache Entry: 420

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):40692
                                                                                                                                                                                      Entropy (8bit):7.995022526542713
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:slf3K5qlwBM1bCgq/s31UfnLjvNNYhqRhEZGrK5add:6FcWbCgCscGqRh+GrKwd
                                                                                                                                                                                      MD5:97952ED4B06D4891FECE3D3C842062B6
                                                                                                                                                                                      SHA1:CFE809DEF314F3D3569FD24ABA48F00001678684
                                                                                                                                                                                      SHA-256:DBEC46F7F8D5F6A8C9F734ACEF8AC317D05270AA26174E2B875EB44A804C10D5
                                                                                                                                                                                      SHA-512:D40E0038A3F3DE00D59DAD8BC46FB400A2EE167E34EEF577EDD0AFE5A746837D7347EE4D2FA99A25BE60955E2C79FCC7CE9AB05AE0AF1F7D666CFB36EAE3786C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/gAXB8cWzBmKXUYY45OcKqqotHQ7oreHsV4EpXUxnjXWoWoLSBYNFxoDazGgvqsuV40g=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ....0....*..(.>m*.E."..;vL@..6.\...2.{.l...W.,..............e...>'.....g./.O.w........e.T......./...o..x....^............/.K...W...?....q=d.....1.u..........._....1..._.?.xK.........G.....}........3.w...?.y#.....>....S.c...../.{.x......}.._._......................g...|6?%.....W..............B......._.r...........g.......m.........+...G.......o7...Eo..h._.?J..-..%.4..Q*.;Y...Wgg.6.f..4Zu$....t.."..Rnsp.}....~..2.&....tF^2.).?6%..g.....7...D...j.g..G.....h..E..X.+....*'\.....}..&...D1..\.*....\..L.....5o>..u..V.....i{.^.........u...)B...!.hI'@M .]......{..uy..z'..3.{...E.u Y.].....=...[..GP.(.E..=.....32`7...V,.K..;..7.^!$PoXv.......K>....p.(......P?O.:..........r..8B0.0.o.pi..t.H.N.H..TX .9|......';[Wv.V...;....SRV~........m.....W..j.L1...&t.f.8..i.w.'.|.@....-......Xza,....3s.4..ykw..5.&.J.%.......(..qt..d....P.....[.vgX.#.2.....Hk.{...[...W=-.j.A.Y..'.q]..i.....u....sb.0...g.S.2-#..".+l.Ku\.VB.D.qb.E.2...@96.v.4.OQ...

                                                                                                                                                                                      Chrome Cache Entry: 421

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):27764
                                                                                                                                                                                      Entropy (8bit):7.992358323769748
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:gUQRW/ew0SXJlFnDuF2W5EddDde5gwPyp365YDIoX3nvG:gUQRm1ZTDp5DQgwPyp365YD9PG
                                                                                                                                                                                      MD5:4FC69F89F72C19287229FFE2728DA8A8
                                                                                                                                                                                      SHA1:DE9A27EBB7686DB903040347D503DDCA5BC7AE84
                                                                                                                                                                                      SHA-256:7B877924FBF08113E75D32AB3B765DCC0A00DF412072E4B90CB0181CAB2D4A0A
                                                                                                                                                                                      SHA-512:8908D7AD607ABDEC8C1CFB95E9E6F13BEAEF9945D3DD627428B731ADBDEC5B8FD124C798B13AACFAD798F1F42C0150FAAE6281626FCC9408B18D906E8179858E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/mobile/mobile-slide-4.webp
                                                                                                                                                                                      Preview:RIFFll..WEBPVP8 `l......*.. .>.D.J..."$S.(...gn........O/.....mB.{..=.s...g........t._..*Nm..+...`^s.............e.U../..`..oY..........._.?..`j.y3._./...............=.....'.oh...V.o........{.........W.....x....... ...,.%...o....Mk....P_`...S......s.f.E.3..._.?..q.1.......G......&>N.Q.o.......e.....a.....7....?.?..........o._..|..4...o.?.o}....~.~.......}....a.qt.s..I.Y..5.&.B.y..5B.E+.h....)^kDMP..J.Z"j.,.W...T!dR....."..D?|.....Xn.VV.PB.\d....H.M..l"e?....y...#....E..(.mB.y...T.2.".............(J.f.w....?.v..."..".6}.E.Jy.T.M...C.ZU..9..9.-....CzvX..O.h-..0...?.PQub...J.g&.....w.2..1.."..e.W.....Z"j.,.p.f...."..D....{.v8.....o.{.5.)-.|..d.#..]....g.ET..L.7......5.....^.=......9.o.. 7t..d..t....V....V..2...c.).76.j{.Flv...(..gtH....e.3....5*9...>..9.ZM\...I..P.)^kDMP..J.Z"j.,.W..&.dR....."..D.........].*....J....../P..&'.P....T6n}/.MBW..- ...R..S..#k.R......K...... $...@..#Y../Bjm.B0$.Z.....*5.("v.....<............uB T

                                                                                                                                                                                      Chrome Cache Entry: 422

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                      Entropy (8bit):3.75
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:H0hCkY:UUkY
                                                                                                                                                                                      MD5:AFB69DF47958EB78B4E941270772BD6A
                                                                                                                                                                                      SHA1:D9FE9A625E906FF25C1F165E7872B1D9C731E78E
                                                                                                                                                                                      SHA-256:874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
                                                                                                                                                                                      SHA-512:FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk4BRY1LvFEvhIFDVNaR8U=?alt=proto
                                                                                                                                                                                      Preview:CgkKBw1TWkfFGgA=

                                                                                                                                                                                      Chrome Cache Entry: 423

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):148
                                                                                                                                                                                      Entropy (8bit):6.523312318185472
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:clyg1ZreK5l1GzQ9O9xbSj0hGqBBs+dK484MVYQkGAKAJlJwBNlWn:coWZaKBUdSghtBfI43M0VJlJkWn
                                                                                                                                                                                      MD5:F6FCD4D43487A3BF8F47A592569FAFEB
                                                                                                                                                                                      SHA1:22B1887F1C703EA9ED827A59B02AC7FCDF79CA54
                                                                                                                                                                                      SHA-256:C6AEC5614A1193CCECA829712C4027C6F1B94A106395D2223229861AE110A9A4
                                                                                                                                                                                      SHA-512:98ECA13BC52869440EE4319FD09AB3C076EFBD51F769052B8C85571236355E50D5426F15CFD67F4DC1942D07D72A0BF0706ACADBDFC5CD2082645CF746778443
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../......j.....]@G....51..C..G.3..<...w..#.O....{.P...I).......T./]......}..1^..|.~.}.B..B%.JP..%.\..%..$..K.Y,".\../?#..

                                                                                                                                                                                      Chrome Cache Entry: 424

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):932
                                                                                                                                                                                      Entropy (8bit):7.790466406012738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:0fIOTOcldz7O7J38s8dzEkqanWHSO9x/HOz2hnCQ8XMX:0bLJA8ndASWHn/HOunD8a
                                                                                                                                                                                      MD5:D28C9CDA632F544CD72F5CC7ED1577B9
                                                                                                                                                                                      SHA1:213CAE0547E8C34D8DA68610CAFE2CF727156E1B
                                                                                                                                                                                      SHA-256:2DD183C9AE13AD1A3872687B71CD2FC3A2CD982C2ABA479A94E7549F08F2F589
                                                                                                                                                                                      SHA-512:BC9BB345B543C114CD0F94156B74E7B78E4CE8879FD02B19FD41276EACAA991A331B439C4E8C79109751D91300F539BD72C974FC31DD78AD2094552CFD76541F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/QpxlLXo0x3eYCMwdWuf172x0_Rd_mOJ6THuhfEJYl1l-fjnq5TFT_n-prZ3yD8qMH3sv=s64-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*@.@.>Y&.D.."....8....W'.?... ?...:Ps>..m......;........@.+/..._.oE......nM..O......Xz.z...._.%=yy9.+...RG3...4.K$H.C.......W-.z.].-...A....0].Z.[/9(.....=C..e'\N.....)G9..3=A........2.:...5...T$4z.Y.].1.:......O.9........T.pFN....eD...'8.m)LI..H...B....\w..8.t..........@9.E.}......!.;p}......^.H..M-..i.e.....e~..*$.Fu...../..j-.8J..ySd...8.$...v0...v[[..m:.r......d.4J<U...4cg.... .B{.P..L.)..7..k.j..z.............n].z.0.m/a...B..Q..l.c....2.6.n.8.N&.,.o..x...=.).<.I[.....u......Rn{..*...IU]/..V.w..g{.y..)...,..{CVNH....wL.T........\..<d.."G.3.D...*.i.>Q.....q..o.B....[`....< .....{.(..*..8fg..C..M.A.>.......\9.o.r....x.,..R....iwC...+..>eL..+._:.qx..*..=.... w57I/ ...Tb^.^10.H...h.=..'......._.`.{..yJ?$.......L.......pf.lb...+..2..$....mk.x..!.O.S.u.`l..2.N.8....oN.M...T......o..;.SqvP$R<.h.e.....X..8.IT.9...b.g{..4c5.\...P.G.e......_..m.K.0.].M.d.6.>.H..

                                                                                                                                                                                      Chrome Cache Entry: 425

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14588
                                                                                                                                                                                      Entropy (8bit):7.964559576149324
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:mUJ6xOHV90/Zs4xCbp66lClUi7snEYCKtx:JJ6xO190/NxCbsNqikaE
                                                                                                                                                                                      MD5:A5C6E9A7E02C954C0632FF808377022A
                                                                                                                                                                                      SHA1:CCB6EE20076CD565F7741707A0DEDAF69410F50E
                                                                                                                                                                                      SHA-256:9F974F65DF6B98CED053C78DC4D7A8A8FE86B8429C4603256B9A2712B079A953
                                                                                                                                                                                      SHA-512:3463DBF4DF5512F7F0C4D66144BCEB612C6BB64BBAEF8F36BF1950D57A7327AB151122D881F462FE10AB34F1B78B3A151460E616C69B8AA44CCC60E2E9236AF2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.8..WEBPVP8X...........'..VP8L.8../..I.M8l.F.F.....d./ ....W...C^....k..j.^...S........7.&.}%...%......J.y.....M.Z......T.!....j..s6...l.}.Af'l.I.C.....\yx....V.(..3...{>...I.#'.-8.....<.......2p..k.....h......^....l......(....C......O..u);.H.Vj].[....~.N...U.sv.J.T.r=......e. l....\o.....N...\..\....V.&.n.n.c....u)........Q.@.....d+[.J.G9..ZYS.EQ.!.3UY.-.N..f..t.N.E.{...`R.$....J-.sC..?F.x..?&0......F.*F|x...v~.q+U..L....@U<..ZrZ...t.'.n......L+..h.+.;0.$4.2..).`......!............l.Q..p.2.....l.[...@....*..m#I.D..........wFB.........*..x7{^|.Oj..Y...7>s....>...yr.+.\..Rp...IG[%s.l|../..ff.gf>..!....eff.0333s..c.....t>.......r.Q.z..[%mo.....v+.V.X.7.H?+.H.l3n-.\.L.._..Z.F...ne..S...X..p...........$O....*]eK..Zb$.........?..@.....H..I.Zv..............l../r....Cb.eV.q...........!....N.S.k..A.%....._.XZM|....c......YU..W...,.N..S-..f9...2...u.*.j..T.|.G..X..%o...n.|:.e..Zk.m..$.}.}.....HD.m.m._m.YV...i;......g....6...8..A.+.j...m#k........"

                                                                                                                                                                                      Chrome Cache Entry: 426

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3371
                                                                                                                                                                                      Entropy (8bit):7.861369895028707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:0VhmKeLQLVeHFE7Vg+hhK1sB11hCYwuHxawn:0VsKeLQLIExg+hhpmYwGP
                                                                                                                                                                                      MD5:F26F7F4A5C1A4B1797459C31C58C17C5
                                                                                                                                                                                      SHA1:66A4995FE9AF59093F3596BDCAB2A280654B5069
                                                                                                                                                                                      SHA-256:ABC5646039F6994940432D272D7DE77BFEE7A46C335C32BF55A6867A2D9DA8B4
                                                                                                                                                                                      SHA-512:99A5F12D95D214A850DB877A7C83C83917FAD64C423E9ECEFCD9799BBF2D231DC8839469C35C86B0F19645DE78F75E6EAFD86452BD570A93FF2BB116FF5CDFC5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/footer-icon-1.png
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......IDAThC.Yi.T..>.^.{.M.":J.....h$..J%..IL...K...^.RH...H..&....r....%..S$d\c..E.A`z.....{.....T3.!.......-g..w.s..'..O........H............j....ZW+.J....<q...H.....&"!.23.........R....`.R.`.9...%.v"............._....Ri{KKK.......|>.aY.7a...+..D.@'v....r.\:..M...h..}FD\.T....L"......U.A.=.y.....O;....mg.v.....=.R3...........D...19..g2......T./"...#"dc..C.. ....af^.d.M.]w...."."0&...<.q...X..h?..(...$...|..J...y.&......BD.Z#f.`..m.....e...j.zM2.\....R'1..D4....D.-f..8..1;...r...R.0...h/.q..c..h.Rj...e.y....B.J.R!fF-......3.ND.q..yAoo.+.t......XDPGx...,..b.h. ..+..AA......@...%.W..D"...H..Y .j..d2..m..3.B..@D.t..B.....\..2T3^)..\./O.R....hX..6.r.. ........_""`..J.G........../.7....h$.H...BZ)u..\f0?*..!.@.z........l.|ADV.....n.. ..d\DY).b....=.T*......@.9...5.....:...p].Tf.ZD..g.D..3/...}u...56..p>.Ok.'...#..KD.)".4.._).......t..C..P.......Y.........f"B..A../0..7n|...t.D>.?..-"_g.V"r.L=.....ND+.R.m....a.:.Q..".

                                                                                                                                                                                      Chrome Cache Entry: 427

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2722
                                                                                                                                                                                      Entropy (8bit):7.8727726962438425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ByTJzer8qxuEKO+Wo1V0u/ziv712frevONVHVOyrQlJLZSiSaJqs:BqY8CLKOfo1V0u/zi4fyv0ZVOQQ3Z0a3
                                                                                                                                                                                      MD5:F05DD12540DC41F4295B4268AB93049A
                                                                                                                                                                                      SHA1:B25FE803B71C98ECF0766C2BAB88DDF4935231C6
                                                                                                                                                                                      SHA-256:3315CBBBB8A58D16B91DD5437707FF4D0AE387CCD2F36F3004327233A273BAE4
                                                                                                                                                                                      SHA-512:6FFB038A13DDE599023C675F7FEF1D8EA2D0A53A96BC6CA3F9B7FD9D7246E3D63DC00529D6738569628A4ADC3F68FEF5C30067476AFE0305C898EDC7DBC3669A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/device-2.webp
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............ALPH.......m.!I..D.g6.l.m.m{......^{.ms..Fd.\+2....`...8.B#WR#..1@0p......@..V....m3......9.g.....z...........O8....'......G...=<..w<5..@.....s.'..VA.v....?..........o..A@.....G.......9...V..]_........ .3m.i...:....+-id..,.......Bi.I;..............?.......\i.+..V.GA........S8...W.gO..I.w......m..q...>.9......'.cU...gAd.1..C.u......D.&dD......\E}...<.Y.1.."6.|...r.8G.<.R.z......?;.y.5 ........`3d..;aB......2.;....e...@.8;.......`..hHBP.1..SjCa..[..! .......CL......H.....A1.Y6epB."c.e. 2N2."....$81"p^......$..@lmV.A.&.$hV....&.3.#...&.:......5A.Av..d..!60. ....L....D....f:......D .7..q.#$0)b.....3.h,..2......|3$IN...f.?~mZ..0.'E....r.)].Kf.....+0...w&.......:...q*d`....G0..............'....._........_.eO.,.........g.........."3.....^.z....Q"c...z....z.........`r.g\.}..s?......oc......{3......8..0880.$..M.M.._..0..._?.K.uP.@f......}$..%0 .b.&...`....A.M@...s... #.M41.......D.MB..q4v.....@.dC..D.....@..0....A...&.&...

                                                                                                                                                                                      Chrome Cache Entry: 428

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):12334
                                                                                                                                                                                      Entropy (8bit):7.980134804009098
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:izsDqzecodmBMfXZCYiw0lYPOK2qP//EhZTG5hDmQ+3JpmB3ExxKuXF/AIYxprxr:+sDvw2OKtP//EVv3Jw5sFoIGO7
                                                                                                                                                                                      MD5:1550C707D9C90A1111CB1966220DA16E
                                                                                                                                                                                      SHA1:D6B8035ABA9288D7EB26C9201E0A2CC983FCE576
                                                                                                                                                                                      SHA-256:B57066A6320BFEB575A2CCD3EBDDBF1547BA3C5CF791DFD60E446B2C4CCBF812
                                                                                                                                                                                      SHA-512:7C6D5B89561FE40C7432AFC04B3CECAB85E4DBC3344379C5AD14B9F913C92BBF1F42668BE20C47770138BB75615B4F804503F91DF73B7C8D5AB9482193DBC9B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/image_more_3.webp
                                                                                                                                                                                      Preview:RIFF&0..WEBPVP8X........)..{..ALPHg....w`6..R.(S.b.....<.5..&..(m&.O.H......PB.............X..y.....$O..1....?............?....#.$c..$Y.V....VP8 ./.......**.|.>)..C!.!.........wSo.K.Y..@.M`..6}....?..`y..o8x{.J..6.....l..|/.7...'...W.......>-}\~....]...O.O....?...{..........7./h?.....?....0....g.U.s.w.....?.?............W.?...?.<..O...W.O...|..../.....|u..............?........W......s...9.../.?....i.............~4 .._.....~..r.....K.K..............c.....?.....}.......+......E.........?....P...../............?...............O.?............o..]....=.U..~r.....]*.s..T2.7.t.e..J.`....B..0.\...........E..E....Y...P..6........'..)...;.n_t.5.v...|.fQ..,..DQ..k...P..5_.).2.f..iN......t...zB.o.O+......0o...9.Q..Ad.....z..c0_=?.._}..Eb.....n.SP@.cx..#l.1..&....\..*.+"#.o.,.....v...<....4\..1..de...6G>k\.|..l.lO.....U.....x.+a.v^..O.-..+#..\.w..s....8...~w.H...5B.2o.4.k.&3..>$_......v.j.C.4.nC$c7.Y.+s'..W...OV..3.!.!...1....{VQSQ.`..b..C.(.Y..~'d._N+..._{1n.i...

                                                                                                                                                                                      Chrome Cache Entry: 429

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (14239), with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14239
                                                                                                                                                                                      Entropy (8bit):5.33042281088163
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:3I2fNaC8QiHbcggNFUWTgMe91sa6XCZy54:42fNaC8QiHbfgNFUWg17slXCZy54
                                                                                                                                                                                      MD5:70B4897108480DBE11C443C2AB7679C9
                                                                                                                                                                                      SHA1:70DBFD38A0F1FC3B1A7D9FADAB58786484C34F17
                                                                                                                                                                                      SHA-256:F268612BA59EAD1B24353BB77D66783BCC435AFF1C22BE5F93C40BAC3869968E
                                                                                                                                                                                      SHA-512:466084FA711D299E394E96C2260BD8BDF103CF75DA8869934C997A19FC884D6DDFA2E92CE253533A4A0C5D627D580E9A40EFB7155F1C8C0E9FBD3A2C3A06C2AE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AOS=t():e.AOS=t()}(this,function(){return function(e){function t(o){if(n[o])return n[o].exports;var i=n[o]={exports:{},id:o,loaded:!1};return e[o].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}var n={};return t.m=e,t.c=n,t.p="dist/",t(0)}([function(e,t,n){"use strict";function o(e){return e&&e.__esModule?e:{default:e}}var i=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o])}return e},r=n(1),a=(o(r),n(6)),u=o(a),c=n(7),f=o(c),s=n(8),d=o(s),l=n(9),p=o(l),m=n(10),b=o(m),v=n(11),y=o(v),g=n(14),h=o(g),w=[],k=!1,x=document.all&&!window.atob,j={offset:120,delay:0,easing:"ease",duration:400,disable:!1,once:!1,startEvent:"DOMContentLoaded",throttleDelay:99,debounceDelay:50,disableMutationObserver:!1},O=function(){var e=argum

                                                                                                                                                                                      Chrome Cache Entry: 430

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 648x364, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):47368
                                                                                                                                                                                      Entropy (8bit):7.9963799118254375
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:LXMoFl7JOLBylFJCoSTYcPLmbUXlJPJ5eqDLyrfj38YHaiU/9rVMtDYFgAIp:rtlNIBWFJCqcPybUvJ5eqDLyrf77U/9w
                                                                                                                                                                                      MD5:C9474640ACA7313DE89B22F356287C6C
                                                                                                                                                                                      SHA1:42F3A2143411D230EE7004872A894005E82CC1C9
                                                                                                                                                                                      SHA-256:F99C0A263BE0A245F5DDC6D479348C049A431B1FF1E19A2A320F9A5DF10021AB
                                                                                                                                                                                      SHA-512:10A716D5CD8191562419AA41C50602F191C43FDF6FEC71144FFC71B928A483CE5582E99C0F66B564BBD3C576DABAC64003ADDB0A1751846814A0D558CBFB4D8F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*..l.>](.E..!%.......b...W.....e}b....../t...g..i=.....H...9.k...G..Z...{........{..../._...w/.>...z..P.Y........c..S..'./..../.......?........S.'._=.K.....S2}..S..._..-.;._......#.....\+wG......_........?.....?.~....O.-.......?...z?.....3.7.oM....>...............{../Z..#T ...]...k$.....$..3%..l..$....If..(.\.R..Y%Y...I...^.4.j.S..$G.a.....I8U.....H. 5<...oN...z...l...\/......"...1..Q.q....?...K.#NA...9.........-....&Q.G}.....45.7....8U.%..D.a...@..;......#x.|.)../..a.($.......zq....1>.......S....J.t..v.>(..m..z&.2...?...z3tQ......K...w.........../.V....../..I.B+..N^.X{.......B.9<R.x. _...xCl....#.....r.%.~"P..?.5j..RE.Qs...g=...;A...E`.L.~".../..g+.D.q...z.@...o..u<...... w..."....\.}1L.....I..GCZ+.T..X.`].....W.|:.tU.;..e;...m6..".S..sQ....n.H.]..n.a.~......._;......L.{t.d....*....l....J......N...f.q3}......V.X3..../.,...~..M9..E..:.....Du....o....>)....j.......b...?I...=.Oo..v...L)u...0-.I.J..Xv....d

                                                                                                                                                                                      Chrome Cache Entry: 431

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):40532
                                                                                                                                                                                      Entropy (8bit):7.995619656406213
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:k/huNy3xHHS61C7DLFLn2XP384ueY4QKf9roJ+nlwa+z7cz6Q5pmxuP8mh9:kgy3xnz1kpz2XP3yEN9nnSa+vW15oxuv
                                                                                                                                                                                      MD5:581F3D3D49460D70B7727752C3339F13
                                                                                                                                                                                      SHA1:C70220D89F25E1310C2180F280920414A94208B2
                                                                                                                                                                                      SHA-256:B1C9E778A9253BFEC9874245823B23EE8C5BC40D131FAB451F33920EB418E145
                                                                                                                                                                                      SHA-512:020FA8BCE423A980065B7FC72CC61183791FC8A472BFE6B5D077580D787050EBB030F98D6C456DEFE6B1F2CF7B23C76CFA487A1BF3290814EC6BF11C8A7E8C20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFL...WEBPVP8 @...p....*..(.>m*.E."!..X.....fm..#..(..\.r......|..O...~..........?................S...w.O.?R....._.s...|.........w......................K.G.G./.........?..g........i.#...........{......g.K.s..._.}..a.....?/...!.g...o..._..w..|{.Oyo....G._............z..7...../....z..3...?.?......s....._..&...............>B...u...?.O.?..n.......%...........mk~...9.T.......).g../..6{.!.[.."J.o..V.':0.N.{.*......ol.5.........g...y.../ .74..F...8,_.l...i..]hY..!.ky..Y6..9...F.;..e...7!n.?.........i....d...%g{1I^4...,..B.......^..G.l..2._.V...t...5.P.{..........U...K.... F..bG`.h.}l`.......:...p....9..w.V.p..]..........g..}U..I.N.b.w....l@.........j..0........Qq.W.vlG$...Q..... .]..[.+.....D.......0.....h8....#s?.n..F...0...;. L.......2-.x ..../xzY[..J..q.....(..oN.6..p.-....w......).)!i..P..a...F...{ :.XL.S......b=.VD......q.....}......P.|.)76.....:l...Z.+.\./...d.0..L.T......m..U.....v.o..<....KL..{.<..).X./u..f.V&v.]."Um..."s]9.T.....l..L...

                                                                                                                                                                                      Chrome Cache Entry: 432

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):4507
                                                                                                                                                                                      Entropy (8bit):7.8282473005519
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:8YR2MzjrS4AIlZ89VkBePnGImXOXHZOu2WgCaAjLWlbQ2V:Nf/r/AIlZMGePnGzXm5OnWgL8WCc
                                                                                                                                                                                      MD5:19167917AA41E5AFC5EF57D780B41680
                                                                                                                                                                                      SHA1:61B8EDC3FCFD65AD9A17F0E7F1EC4935A7FCD8B2
                                                                                                                                                                                      SHA-256:21DE8627205C15775F3C44CA5CF25F986D21825D7A91800B8F183A93F1953452
                                                                                                                                                                                      SHA-512:665277A8DFB644A537E661D89AE28BE56B35C98498F2DBFBED4BB6B305737CA1D1058C3A7E34EFB5F32F972C8EFEA049A970407FB4DD712E262AB5E479664F83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/start-download-icon1.png
                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:30D31679A48411EAB05FA6B755E57B72" xmpMM:DocumentID="xmp.did:30D3167AA48411EAB05FA6B755E57B72"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30D31677A48411EAB05FA6B755E57B72" stRef:documentID="xmp.did:30D31678A48411EAB05FA6B755E57B72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx..]..T......93....@ ...(..PT.+!..Q...hUL$.Q0Qc%e<.c$...1.r..X"...T.R....XfwY......|.....;..;w...

                                                                                                                                                                                      Chrome Cache Entry: 433

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):212
                                                                                                                                                                                      Entropy (8bit):5.90424772242193
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:8Ai1Z9u5+PODIluOIcSjjaJBBWAi+1n1Fl9Ttdk:8d1YTIlHfSxAiYTt2
                                                                                                                                                                                      MD5:FD346EA942923CE6A19AAFE704CAF7E7
                                                                                                                                                                                      SHA1:3C36340BBBB2D0455604BD479A7BBE9FE355E2A4
                                                                                                                                                                                      SHA-256:D0BAA6814606024D57322978AFCBFA74C6053C79C27B0F431EAD6DE2EFEEAE73
                                                                                                                                                                                      SHA-512:7CCDE5FB098248B5E92553A5B57078E42500E2C0205AFEC0C39A9E1107398EB1B18136E115011D4C6CE2B7E7A91A421941F68201DF3C789F3D51CF56D84FA8D2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/a-/ALV-UjX8hU67pBMLGQ5SKpJnQWffgmmI7_CenZHy0c0etS9BEt9ZenKu=s32-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............VP8 ....p....* . .>=..C"!..... .....A......1..wd[....G............w3x.sscE.b..<...............}.......n_.X......@-G.P-...S.;|..m@.EXIF"...II*.......1...............Picasa..

                                                                                                                                                                                      Chrome Cache Entry: 434

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):39328
                                                                                                                                                                                      Entropy (8bit):7.994553634657984
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:A/WR0bD0TlgaAMvBzBy8EWlua4yrg0yPlnGMMZmXVTI8Wgc1W6:us0bohfzOWlu25qliZmFpzuR
                                                                                                                                                                                      MD5:D99582F67A3ECE0D09B9D9D540FE885A
                                                                                                                                                                                      SHA1:87DD927AD44F8A9EB59BBC13DBE8F89F5E7A2AEC
                                                                                                                                                                                      SHA-256:ABABC2F9BC320FF88E90359EBE4FADDBC51A98C35E2C5783CCF0D5872F3E0C88
                                                                                                                                                                                      SHA-512:0BE4FDC1E427AA9072290A21C19B8D0C0619DC80999FDF9C5DB5AF6B67235D38B87F8CBE817877C6AFCF7FA0774A76451D2D5F7AF7FA1A96344742FE60EEA871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/_LIdWrI6WL3sT9FwQcPgggL6iRrzZ734Ga1hI4e1eUaa0eMze0ISgEHVQzQIGt1TxUk=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ....0....*..(.>i(.E."!.[..@...6........F3=Y.t..~....O ...O....k..v.../...}......+....p.._...r=.~.z......{.....g.G.w.........{3~.....zu..|5.t.....u...........x.......S............3}....W.....'...#.....|..M..._......o}....N..W.w..j...O........./.....v.`?.?..............u.........?..o~..........._........y......l.....~....w.y......F...7^.e[..@Mhl....o...Kx.ez....D.^...Kx.'y~...=s(nr.<..{.3g.)..3.e.j.u..?h".P5J%G....v:...)`..xD.#!.H..cv.Z.Q....Y9.mF....h.-....rSX..j3...-m^..n....[......R.z.........u~....nB....!(I.S.V.x.:..=:.(..h...`.\...jE79..-$.~R.a..]m.....k./..M.....[z..4(...cvu.. .CEU.$..w*.f...f.Y.l'r.r/S.Yh..G-,.Ew~.u.*.C...]ynF.?...8.l+X2}^{p...G..2.R...........:xrHW.zU...@{.b..w...?].........-..'.....?.W.S.t..z.e....h..L.0.^....uq.Q.p z...8r.I...v3......9..K"hC?.../q....~....!Q.../..q..............5.Z....V$=...u...J`[8..;h.....l.;..W.b.{.W).W1..E.D....../...1i..}....C.).9....[y.`.....Dno..D..qC9.....E...p.*d......Z*!.p(T.

                                                                                                                                                                                      Chrome Cache Entry: 435

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4360
                                                                                                                                                                                      Entropy (8bit):7.917777321738175
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:sbeEU3WJLyibOnudbBdc4B1Zw2ESJK/82W:shkWJyibU2dHB159Qu
                                                                                                                                                                                      MD5:C1A049B4158DF0C0AE064169E059D127
                                                                                                                                                                                      SHA1:A185B72EFB20914F9164B2D3B82428E3CDEA4FEE
                                                                                                                                                                                      SHA-256:7F0A36C786B129BFC5A11AA1AD26F789BF88F68081B73706CE262626F80CDC2D
                                                                                                                                                                                      SHA-512:D8116CBEED979DAE222F6E0DC9BEDAAEE09B183D00B54FEF1CE8E6211C65FEA92C85ADC7498AF673E1AEEB956AFD405A7A5514DC59EE68EFAD9E6B6D8EBD3D27
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD..............IDATx..Z{pT..G...,.......0.H.. ..,....HB..P.B-..>...%...)....v....N;.2.Z.....R...*$..$....=w..s..=.{6.o.7.....~.;./....:I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M..n!.Y.C..kD...@tMOO...C"~.z.z.{.9R".'.i3..?pvz....'..g.zx....6.".g...!a.....:..H.((.......?.Znv...-.1!"..B..n....5R.p.l.x.]D.....\.....?I....XP........].c.E.x...:..:.......2........'.1.5O.u.....SI..K*..M....~~]..*....s......k......wd?Q.Q.5.1..B?.z&%%..}.p..j.....k6.._.c....f{.k..s.....x..&...~.|.r.z.z.{.W@}..M..h.\..kM.....'\.5.B~..P.#%.DR@.fl.z(.W....*F7..........jZ>..N...)\.....7.....h:]@.Q.P.....`..k.3...i..,..n....y......!..[|t....#.._.....o..T.........n.:.<.c.......!..P@[}t..N.S.U...Y.].......`....-j7.W..M.}..._"....n.U........w...X........T..bh......l...,.H.o.....=.....^@?.....cA.x.\[..yc.Z....F.'\...K~...h....6........Q|.8...&.<...'9.3..[...sZ.k.i..f....g...C....._$...<n.`.,...i.;(...;..'..&.A..C@O]./rG...

                                                                                                                                                                                      Chrome Cache Entry: 436

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):90462
                                                                                                                                                                                      Entropy (8bit):7.976966393333891
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:05GnkNveINsxitIW2ld1S3b71IQb3xRvc45JlNE2nskaunTsX:05oasxitIdd4lbhZrJY2nPaKTe
                                                                                                                                                                                      MD5:9242E084DEEAAEEE9A7DFC679B51E9CD
                                                                                                                                                                                      SHA1:891D6A2F63AD389C0BE6B690F27FC8BEC7ED251D
                                                                                                                                                                                      SHA-256:F528C0546EFA7DC973F8878D23F8975984C2673D9ACD8FAF141A846623F8273B
                                                                                                                                                                                      SHA-512:477C7851CEE450ADE6FE833C9B3EBBCF427203B56A80A432B86EBEEDB0B62F743A7007C656303C9DAA7F28CEF533F7BC9B302EF32A183ADE7EE0C2847623EDC3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFVa..WEBPVP8X..............VP8L.a../..?.MHl.H.....;..?....".?.$.@.If.b.6I.i.:...X.. ..8.x.Qg ...u.|U.....fZ..W?.5.........2K..~}/.T.....v~.m..e).+.o]...Q.......O.xB.Z.-?.?.m..~.j....$.../...K.........[.$........|..j...[.!.<7.'..+.[.......]..K(...U.2...s(6..^.....p?o[...8.....u..G......I../.$.......I.".....5....s.w/.k ........hl.}aI..h....k.P.".dn0..V].I6-Py.[..$...P..T.n$I......bz...EP..i.........l..I..x.....F.<..9....&..:.4.H#B..t(@...5....Z9.t...$Q2(..._..6J.x.......G....nT....:uB..i...a..!..N...}`7.s....h(;'.....T4..6.6X..!...(.FS.;.s{..3..;.....*.s..q..WC.~.{u;<._./...B..~...%.......l.q...~._...Q....i.|.P.....`...H.t..c!.a/.G.G<)....4.3.N..j&u.&........6.{.......N....z..u&.Ssrj'.4.7.....b.Zp...`aa.....~.....Y7..b.G;.c...+Oy.......h........Y.I[.OTJ..P.Q.....,...c..F_.....x.L..>..k.y(U.q...=...-..r....:..5...T....I...8.l.M.O...<.rQ.q. ...;&]....N...1....}i.....)@Qc`..d.9.........,....w..N.....y)....9p...G..j.p.>...qy.d.U..`=s!nO.....p

                                                                                                                                                                                      Chrome Cache Entry: 437

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2626
                                                                                                                                                                                      Entropy (8bit):7.893439963066842
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:RPHt0br566TChfJu+OXLDv3RfJPOIxdDtm0AIY4gqcH//:R/O5BCRyblfFOIxPm0AIYUuX
                                                                                                                                                                                      MD5:95435F45957212672D08174848909326
                                                                                                                                                                                      SHA1:EF8BD194997C37B76DB2A4BE25E8650DAA3C337E
                                                                                                                                                                                      SHA-256:65CF337B9C3C4B38BF55FB3739A197ED79676B2910009BF7B23A5EBBF21B853C
                                                                                                                                                                                      SHA-512:63AF98DE4C82823ABBB9EBE7A8964DB70918952791F2D658C92832D4339CC88C2572483656B4D87EA2CB6A30A0AE3DEC6D99E1A9C843C373D4A0A36E9E7AD6AE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/device-5.webp
                                                                                                                                                                                      Preview:RIFF:...WEBPVP8X..............ALPHt.....sm..mm.Sm.Ff+...l.vMk..km.m..+.....}?.....0..$..%]_...I*)E..(A..$...D?HJH..e.......w~.W....K....&{...;.....G(.XJ.s.6.n...JIG...M../}...S!.=...c_..R.a`.;.......".}.......)..}.lp...\.h.....7T......./7kQ.....V5..nNl..t.Fl8'6..jJ....MS....R..t^H..4.y.FS.13.....#.d....W._......W._.....l4#.......w..._.<#~..:.k'...,K.J?r.b6.}t.T.h4.......h..z..g...U.4M.'..,..{.4ES.g.{{f@..{wD.(.y.{On>y..i.=.@.VQ.}..3........K.1.....>.3.;p..&.?...[.?p.=!.bX...}.;.{.?..n......."D....b..!M.A..ii4.LJ....IP..ZZji.D.X... ..R.#..ND.6#!Bt0,Z..c..."A,m(.Ti:.dt..H#..i(.....H.......4.4..tf....P..B.T3..F..Zo...I..A...kF.VP8 .....0...*....>)..C!.!..]......p...H..r.R.P.<..........3..t......^......?..d.s...K.....C...{...OU{..dk..3......\.....48..Z0..^t.....c.c.g_.A..R&.-..3a...........T^..).|..........9..~..XT..\.[";\?.n.T..o...W...."u..^^y.e..3Xp*p.d..$#..N$.J....2O/.jl@..u..........N.'..|.a..WN.[...6..IX...H|:...).k.m............'F..

                                                                                                                                                                                      Chrome Cache Entry: 438

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 416x234, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):23680
                                                                                                                                                                                      Entropy (8bit):7.9913839102467685
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:384:XGv70G033zFQvH8VfKJ+A98qxypMFz2k3Qmk3v+erwICKWhMugnCW:2vAH33zF7BKA0yp82kAd/Frwoq/gCW
                                                                                                                                                                                      MD5:DA50F8F49D8E88F6E364E911B1BF4467
                                                                                                                                                                                      SHA1:8770896A042707E886621971CADFABD48D1D4317
                                                                                                                                                                                      SHA-256:30364A07D3B398559DF76948F9645391BBD6F2F4348F28E9F31F8981B228F775
                                                                                                                                                                                      SHA-512:5B13DF62EF683B3ABF012434BCA37BEFCF400039677C01D951E76D6468693F5243E0479FBE4646AE1CBDBCFDD766C16C9FB6CA33A173F8D3D42DF695C643DF79
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFx\..WEBPVP8 l\..0/...*....>]&.E..!.;&<8...e.B.Y}...|...<../..Q.?....z_3.......W././p/...|.}l~.z..s......./..._.j~.?......c...._..p.._.?...~.|,.l.....;.3...G....P....~i.7./..7._.....?S_......<..z...?.o...w..3.?P.o...|..._i.3._......~............w.......:>J..._._.?...?..j...k.s.7.....?3=.~....o....._...........s..G.o.#.zxl<a..j.....u*{.P......V85^..Z.................R..M|..}...O.q.!.6..4o.+.+./..1..(..G1.-.uw....h...!....Vl.#V..9.........H...R....,2x...1J....r..Q.$..n......c..#"...n....[...D....f/.*./....o..dbv.....,..H.9..#.+.K...G.|..G....A.!.H...?....s.......}.m..S.V..:..i.Sa.]|.0.pf.I7a.t j.r.,.....X%..z..|.....;...S...e...#O...p..1..M.9rXK.....>.5F.kY+mSF..0....4u$.8...w...E.j .t..%........"...(....G.}.@.R.....1_.TyJf.......Y=}..E.5:....]NL..7K.....&..*...<..._{yd.hi.o...>KcQ{...Zm..iQ..NJ'..m2f...4....n...[.U..qY.)..#.dD.w....{.u.>,9.R.j..'kr.u....N......9..nM...Wkoq..+r^eE.o.. .A.M?t.....sf.]*..{..b_....g;..Y.M...%.../zZ

                                                                                                                                                                                      Chrome Cache Entry: 439

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):12552
                                                                                                                                                                                      Entropy (8bit):7.972140027143501
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:A83GXWY1cES3sWUW5jNwnji1+S3DxD7oaqEOpSPVgsZgQlMfsDbSgNK4DWO7s2df:A8RY1y0GNRPRoacIW3mMfs3i46OYU
                                                                                                                                                                                      MD5:F3AF256639B57B164A955E3338170D0B
                                                                                                                                                                                      SHA1:A9E729530633AF5FD692753B41B4C82EA9C1BB46
                                                                                                                                                                                      SHA-256:951046F75A25CFCD6980FEE16DA526151E483A33A9C284EDC70013C9068C2FE1
                                                                                                                                                                                      SHA-512:20C6FC7507EA824C45110F439BEB72CBE9312304E4CE32DD1BBA89427997E42C73BBAC7BF9E6EA35486949D436CAF37E16C15170337A57F0E71B990FF2ACEA0C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/Tq0AXOWNsHiJ3RjelBg2YOKFxTG-9lMnHRA4T3V3VDai6Lye_qa72ZFf4TzEZWDdIQ=w240-h480-rw
                                                                                                                                                                                      Preview:RIFF.1..WEBPVP8X..............VP8L.0../..;......|p..... p.@D.'........../.sy.f|#).....*z......./..]N..|.(:...U.*7.d.k.... ...J..........$m..$5...{.$&3....H.j..u...........p....M#I....p....E...m.V... ......H..?...B.2F(..x._.^.p`.1....".p.....c.1.0......#g.....AM. ...k...L.?S. .......O}O.g..i$./...H.....g.........&Y&......1...Db.5kP4i.z.w.s..(..... <.#.!...m..,.}.D..w.q...;.."..s.&...$..9....H%....9.....+..t...8..s..Y}..a..F....H.V.t..../..FJ.^M...E....A.. ...g.|kk{.I...l..3...6@..;..>S)<..}.D.......%...P.R.@..........U....&.........r..yl...$HLl.&.`..U...m[U....G.BkV..A.....$..n...X.....5..$EuL..E.B..+............k.H.........}t.9...k................$.....m7..hc. .....#.A".C;cf...x.4k..wN..;$..4'juM..%l..H..U.IU.6.l.m.3.Y.9ge..m.m.....?.c.j[.c....X.^n*.N.P....D....03..x.X.H.8.Q.+.N:..N.7.v.._$...~......eff. n..'...Y..w....`.gvfj.J.'..jC.......bv.%.a]A..`c..S..\.z"..M..E."a.cI...& ...N...m[.F....%3...Sf.....f=.5.0.0+f.2..mY..tl.V$9.....

                                                                                                                                                                                      Chrome Cache Entry: 440

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):200
                                                                                                                                                                                      Entropy (8bit):6.8089822048404605
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:wl/yi1ZrRl/Kiwi7/Q+x85mmZ4df7UVksyqUjLp/nwoZ9kqqVC03pjpolqeOo:wAi1Z6iP3q/4Uw7fDDkqq40Zjpolqs
                                                                                                                                                                                      MD5:DF61C422ECAE7409B8697262192A44FC
                                                                                                                                                                                      SHA1:D402D28A126D995638A2F434DDBD2B276887B599
                                                                                                                                                                                      SHA-256:329AD3C7AC436F964C7A8CFCC6A74C859B51CDABD8974A65F0836410B11F2DC5
                                                                                                                                                                                      SHA-512:32B50246FF38917D79C18C2750FDDDAFD991EBB72F9B1EADF0FF928FA0F083EE1C6BA74F697549E50743E89E1E9FB547E666A895801669C7AC65219691492562
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/W5DPtvB8Fhmkn5LbFZki_OHL3ZI1Rdc-AFul19UK4f7np2NMjLE5QquD6H0HAeEJ977u3WH4yaQ=s20-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../.....@.m..a...6..}....$../..H..\.O.,.^.C|}lX.|l..<8Dl4<.\,.c....!.H..0..D.....8.D._..6.....4./.a..\.v......._...}.p.|..._.5......SLasI.R...<ODg..Qf...u.-......9..|.6.

                                                                                                                                                                                      Chrome Cache Entry: 441

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2082
                                                                                                                                                                                      Entropy (8bit):7.87795866691455
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LWUAnnDlwaERw+VemOolsOLibpFBa13+L5nJhCSHIF:fAnhwaERLVewlT0bo13gPhChF
                                                                                                                                                                                      MD5:634D682439A142B3BFE3C14C5C332ECE
                                                                                                                                                                                      SHA1:470E0A4FE836F9A10B5A595BF324C06418D276D2
                                                                                                                                                                                      SHA-256:1FBB0E1847A541C90E8AA181EE47D1FE0B5C8E3018BBBD5B7F9127704206AD04
                                                                                                                                                                                      SHA-512:DCBFF2D01E80FEE7D5CB79F61F23121A0F457DACCAE8DC2B1224B1906C835E0F23399C762122A7CA1A1C05FF3F94F843C618F5C594B8E36DB223E41F3B11823B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/a-/ALV-UjWccpt18d8jzuhl7WQ2ZFbqzfU8yWB5bTo-bO4i6qtmpLKp-CBO=s32-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../....M(l.....#.."._.....@.F.?.Y.5m#17?......m..]...k....N,.....{ |......J........ED*.m.m...^.=+.m.e.*..D.{O.l[.......]=.#..1.....R..)C&.+.p...#Ir$;.Y5.{..!...ZQ. .........i.0N.{I.&iV......2........7..s.(b;.v...HE...!."A.@.C*D...(L.".#AX..?.]...).p.vD..... Jf?...w.wj6_:)I.d...)..!..<..#K.R/n.. B`...H..v..Un.i....._..;.....@ d.!.1....024w~...-... B..$..S..P.......3....=I`p.....I.z}...(..S>..B......x.........B/.......2.$-..r..`....K..@...1..b..r.."..1..7...@...}.on.Z...0d|.A.....a7b....B.E.k.U........F r..5.zo./..1.7...i9......*..."...jM..T...]..>Y.sCeH.%.8.o..ws]..!.!c..=..{w...@@... ..@5`}...C1...!.E'9...^/......WG...T.?..~....g.Ji..........2C3.Wg!=r<z.3[..n...mx.ZE-.U...S.ZU.MqxA.....S....'.'k..........3h........t."V...?5..K.HY#.d.uyn`...[..c.x...y.O)6........>......A.*.S@ZT....t.6}.....h..S.g...L........lN". .2d."....@.@!\....."...7..0.d..__..........W..^o<....-....CDH .p...T.$......nz..x.........t.A....s.3.........

                                                                                                                                                                                      Chrome Cache Entry: 442

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):20504
                                                                                                                                                                                      Entropy (8bit):7.944781615549727
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:m9m0Ya2WVOAt2z3qfnLq40sfvvKRvuq3qjogJo0xBUiVirZ4FCN789:m40cX02+fG4RKc8GogDx6N4EC9
                                                                                                                                                                                      MD5:8ACBA1B03533A3D4B0482B3C6193370F
                                                                                                                                                                                      SHA1:2CD76243AB1AF281CF9768E2875C1DE9BA3FFB10
                                                                                                                                                                                      SHA-256:347D1E941D911C7083F13D8192D5B56DD64E09E043FF3761777D44F973F7C588
                                                                                                                                                                                      SHA-512:9F67465AF49CD4B7EBE37D6110C860054B9F34E64FCB1D198D5BDEA2E15D65F8C4F37C559E38FDE486B5C72EB6EDA25CFB0ED465BFEC20C18DFA1D434F25B4F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.P..WEBPVP8X...........'..VP8L.O../..I.M8l.. .l.3...7|j .....+S.$.....W,;....L2sc@.....wB...Q.&:..v..~'AtQ4..BrN.>.0.x.c.w6.........7^*=Mz..7.B.4u..s..Q.1...D......u.P..]5B]..'n$.$+o....S..N.....b"!..H!.^.pk[R......`a.k).H6.1{]%..I.m...<9A..C|.E1.Z.N3-...H.$..G...q5.{.e..............jm.L<-_.n0S....n\...\.g...z....r...^z.b.fNW....:*~.fN3..i......#...............>^.x...V.CR.@D...P.DD@.Y.F..1.....Mjs%F.SN..57.;.#.b7.{'.$W....+.\f.....'..&v..d..W..$....'..5:.{....kOlg..l.6[Y.l.f.4.|..M.s|b..$.-Z.|.....J....U..".""1... "."A$.@t .h..D....3XD...XDp......AD.X.5.5. b.aW. .Q.........l1`.......!.....D$......k.8..H...".|........hXDD.%.....$...O.I;.="&.....8t.B..T.....:a1....$...M..Z:..7.H"..:...>..'w.h....M...:R...O.m.r4.V..L.sDlff.s..g.BL2...3...f+...d....I.#Y.=O!y..I...d'.F.$I.......Sy.....$IV...0...x..e.V.h.1.Z.bK%Yfv...w..}.[.T\FYV.mK2.2s..aH..u..$.Vm.-3/./f.._....!.1...$I.m[.$$..j.V...?:ki...`...sg.w...`k;$I...FU..6.f.m.m...;F.m[....."...%

                                                                                                                                                                                      Chrome Cache Entry: 443

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12334
                                                                                                                                                                                      Entropy (8bit):7.980134804009098
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:izsDqzecodmBMfXZCYiw0lYPOK2qP//EhZTG5hDmQ+3JpmB3ExxKuXF/AIYxprxr:+sDvw2OKtP//EVv3Jw5sFoIGO7
                                                                                                                                                                                      MD5:1550C707D9C90A1111CB1966220DA16E
                                                                                                                                                                                      SHA1:D6B8035ABA9288D7EB26C9201E0A2CC983FCE576
                                                                                                                                                                                      SHA-256:B57066A6320BFEB575A2CCD3EBDDBF1547BA3C5CF791DFD60E446B2C4CCBF812
                                                                                                                                                                                      SHA-512:7C6D5B89561FE40C7432AFC04B3CECAB85E4DBC3344379C5AD14B9F913C92BBF1F42668BE20C47770138BB75615B4F804503F91DF73B7C8D5AB9482193DBC9B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF&0..WEBPVP8X........)..{..ALPHg....w`6..R.(S.b.....<.5..&..(m&.O.H......PB.............X..y.....$O..1....?............?....#.$c..$Y.V....VP8 ./.......**.|.>)..C!.!.........wSo.K.Y..@.M`..6}....?..`y..o8x{.J..6.....l..|/.7...'...W.......>-}\~....]...O.O....?...{..........7./h?.....?....0....g.U.s.w.....?.?............W.?...?.<..O...W.O...|..../.....|u..............?........W......s...9.../.?....i.............~4 .._.....~..r.....K.K..............c.....?.....}.......+......E.........?....P...../............?...............O.?............o..]....=.U..~r.....]*.s..T2.7.t.e..J.`....B..0.\...........E..E....Y...P..6........'..)...;.n_t.5.v...|.fQ..,..DQ..k...P..5_.).2.f..iN......t...zB.o.O+......0o...9.Q..Ad.....z..c0_=?.._}..Eb.....n.SP@.cx..#l.1..&....\..*.+"#.o.,.....v...<....4\..1..de...6G>k\.|..l.lO.....U.....x.+a.v^..O.-..+#..\.w..s....8...~w.H...5B.2o.4.k.&3..>$_......v.j.C.4.nC$c7.Y.+s'..W...OV..3.!.!...1....{VQSQ.`..b..C.(.Y..~'d._N+..._{1n.i...

                                                                                                                                                                                      Chrome Cache Entry: 444

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):20328
                                                                                                                                                                                      Entropy (8bit):7.992131068751189
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:384:R4okm0X6Y+804KjdONzEstklmZRMsisYRjmoZTYuC4Q9/BFEKM7nBl:mokm6VbqjwNz56QMsisYRjRZTY6eBKKS
                                                                                                                                                                                      MD5:58C7055FCACB604A63D4F123ACDD5A1B
                                                                                                                                                                                      SHA1:1A3BD7119F3F03A7BA59B3407375D1D420FA8FA1
                                                                                                                                                                                      SHA-256:4F6FA345B5584F355421C0D2635D8052855D69EBA61146342AA6DEBE4845A7E7
                                                                                                                                                                                      SHA-512:D0964BDD4C0590D6BF7D0D17BCC4845CB4DE7C0D24FFC54CE58ECBD799C08634AF25E85DAFA56559C755C44811897436F097C202108B802DC6E55B371535E463
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/mobile/mobile-slide-5.webp
                                                                                                                                                                                      Preview:RIFF`O..WEBPVP8 TO...f...*.. .>.@.K..&!.1j....gn..6.....>.8...x...O...g...y+.c.......z../...U.w./....P...?..n...[.........W./.w.....O.^...>n...../.^8.Y.'.}..._.k.M.m.O...?.{..'...?.?L{.{{..dv..'.......w.............'......?.."...C...O...Ov...p}.~....?.I<Q..R..i.GE..#...y.....#..v..t[..<..}.G..o.H.:-.i.GE..#...y....fm....Y.3#...>58..]..(.l\.;.6,.....U..:.d.D}..4).. ..`.TI hg@.yv....@...!#.:j..9$.#..TF..NCR.......23$..F..g.\.......U..3z2...'.0=..S....&...b1X.{K.G9.?g..B.L...x...x.U.9.S...-.R.h?.s.G3?..E..8...=S......t.....s...M.....?.y..\.lJ.k.-.Q.p%.*!....g_./6....M.....I.....{.....+...Y.^..w..9!AO/a.......P...d..m8......"l..-..X.d.F.c...V.B.J.V.a.b..G.6t...(..&2,...P ....u.V..........Tt[.6..t[..<..}.G..o.H.:-.i.GE..#..w.#...y.....#..v.8J...B.U.k...c...f.1....x.m,.6....V:.&./..(.x..........7...f.Y..Q...N`6$.....8.)>.....|.`...<....=....H..4.b!~.EfSz.9...G.E.D...v...gdN.....Li...}.0.bw.a+.......M.%...".r.....s.BH......n.~...)...Jo0...z..Zb[....A...

                                                                                                                                                                                      Chrome Cache Entry: 445

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):15742
                                                                                                                                                                                      Entropy (8bit):7.987435431620976
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:rSgE/rsWBEBVleHQZk5PtkJ8ydwFMQbvEnSideDbE:WnrlBEBVliQSPtkJ8AwSQjecQ
                                                                                                                                                                                      MD5:0CA92FFEFA961F83064FE5FEE52C99DD
                                                                                                                                                                                      SHA1:59C5D5F1821274B00E103DBA07CDDC857C4B42A8
                                                                                                                                                                                      SHA-256:F32E8E7F4D7DAA42569D62624C20063A956DBCA27A660BF0F0B28BB55F419CE7
                                                                                                                                                                                      SHA-512:3CBD1FE45B04240F6A00560722759D17A0C77F1F7B2B11FFAA3AF744907DEF510643B8FE2D90BAC3135FF29749BC4AAFCB2DEC71BA57E0BDF6B7B172CD0CC490
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/XRDaSYtkE4CmnsfdfgH7CGPmqCDJmeu-h1_J0qwXeHn5yu4NpZWyGRN60yDRYS_wVwg=s256-rw
                                                                                                                                                                                      Preview:RIFFv=..WEBPVP8X..............VP8 .=.......*....>i*.E."../6|.@..h.p..ge.....*}..?.?.......ky.t_.?........D.7.o......V../R.......7.K.#.....oP....z.=..s.:.u...................C.."....G?$.&}.j;.r?......~........}.....z......r.3......._.~.?.....'..........R........./...O.....?.{.........;..9"...l.P..S.......Bg.k....7..MO#/.n..u.^.Qi.l.Z.....y'bw.._.w/..9}I6.d.......0<..Y5.Y..^.....$Y.."....M...h..5..kqk.Eg.....4....H.3.1<.......P...}.E...@.*Y.........=4.E..........c.(...p..l...zJ{..,..[V`..|.:.A...`4..z..<...S.....]X.9_...3.;...o.Q(....>&.>.O.....Kn^.E.ZP....,...G....F].l_.y......W....V...Z:.Om;./..7E.t_.Z0..-JV....*.J?V....I..K..y.h.2X7.S.(R.F;@..>.."cZ.../=.(X....*;BX-X<.h?L.6...4?.%.<.5...T.dx;kx....p......o<..7R.e~.2.........*Aw.F^..7.,...7.o.yY.W.....oY.B4W.U.......D{;.....l3.c..#.3g.g.,.p.....].=.M......y...2.(..../4.w=a.<. .H8y...y.9K..t......>(..G.......c....J.<.:.....cx.......t~C..|.v9...n..`:..Y.h...L.&Z...^m....".......?..s..eR..<.9bt..

                                                                                                                                                                                      Chrome Cache Entry: 446

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (5945)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):279903
                                                                                                                                                                                      Entropy (8bit):5.612135670818199
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:c9/pmFU73li04d7G3BsEemvelNPH0fxnP4:kgW734nhifw
                                                                                                                                                                                      MD5:0D8FC66E7BB50DF0F483AFA5CD0E07EB
                                                                                                                                                                                      SHA1:F2EB9B9DC1C7ED775AD231F93060A49C3D1D1EBC
                                                                                                                                                                                      SHA-256:780FFF4E94F61242E80B4C28804FE535648A8AC6706F04DADA2B3F85DCFDF1A2
                                                                                                                                                                                      SHA-512:FDDBC6A4C08F25DE7B128D3DD358B90B3BE2B36F956B5D830C8FBADD0543CD6A7A08F9C1F62DB0F29A04E396A9E39387DC4E544A14B555FA7CC9ABFC890E4EB5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":8,"vtp_value":true,"tag_id":10},{"function":"__ogt_referral_exclusion","priority":8,"vtp_includeConditions":["list","neat\\-reader\\.com"],"tag_id":12},{"function":"__ogt_session_timeout","priority":8,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":13},{"function":"__ogt_1p_data_v2","priority":8,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SEL

                                                                                                                                                                                      Chrome Cache Entry: 447

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (785)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1371
                                                                                                                                                                                      Entropy (8bit):5.333014430130814
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:kzyAq1JWvJfRFbtWWS/Cud1QXo9XjIc/Gb0FoGb4vbpAvcEJ8TkT/t1GQ3Qlrl:ky3evJbJWx3XjIc/Gb0FoGb4TpAkE7qT
                                                                                                                                                                                      MD5:E6D167AFFA383ECA133AE1FFA2B5C19A
                                                                                                                                                                                      SHA1:9B2F74DA5D9EE21D512538AF44588C9BA168B658
                                                                                                                                                                                      SHA-256:518F94797177FE1FE3299E4C20DE8D7D33A2C84A1F2C05D4BACCAF998D28EEB7
                                                                                                                                                                                      SHA-512:050BD849075DBB4771C34CE824692225A7EDCF63AB2435FB2527665A1891FAFBF5BB93A896998A92E4DBFB95CC71844ACE46584D6ED8849202B1029CFB472F43
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("P6sQOc");.var bab=!!(_.xf[3]&8);var dab=function(a){const b={};_.wa(a.va(),e=>{b[e]=!0});const c=a.O(),d=a.oa();return new cab(a.W(),_.jh(c,1)*1E3,a.H(),_.jh(d,1)*1E3,b)},eab=function(a){return Math.random()*Math.min(a.oa*Math.pow(a.ma,a.H),a.va)},PK=function(a,b){return a.H>=a.W?!1:b!=null?!!a.Aa[b]:!0},cab=class{constructor(a,b,c,d,e){this.W=a;this.oa=b;this.ma=c;this.va=d;this.Aa=e;this.H=0;this.O=eab(this)}};var fab=function(a,b,c,d){return c.then(e=>e,e=>{if(bab)if(e instanceof _.Xd){if(!e.status||!PK(d,e.status.H()))throw e;}else{if("function"==typeof _.cq&&e instanceof _.cq&&e.O!==103&&e.O!==7)throw e;}else if(!e.status||!PK(d,e.status.H()))throw e;return _.Sd(d.O).then(()=>{if(!PK(d))throw Error("Cc`"+d.W);++d.H;d.O=eab(d);b=_.gj(b,_.Via,d.H);return fab(a,b,a.fetch(b),d)})})};._.Dq(_.zLa,class extends _.Cq{static Ja(){return{service:{qO:_.$$a,metadata:_.aab,q0:_.Z$a}}}cons

                                                                                                                                                                                      Chrome Cache Entry: 448

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):39328
                                                                                                                                                                                      Entropy (8bit):7.994553634657984
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:A/WR0bD0TlgaAMvBzBy8EWlua4yrg0yPlnGMMZmXVTI8Wgc1W6:us0bohfzOWlu25qliZmFpzuR
                                                                                                                                                                                      MD5:D99582F67A3ECE0D09B9D9D540FE885A
                                                                                                                                                                                      SHA1:87DD927AD44F8A9EB59BBC13DBE8F89F5E7A2AEC
                                                                                                                                                                                      SHA-256:ABABC2F9BC320FF88E90359EBE4FADDBC51A98C35E2C5783CCF0D5872F3E0C88
                                                                                                                                                                                      SHA-512:0BE4FDC1E427AA9072290A21C19B8D0C0619DC80999FDF9C5DB5AF6B67235D38B87F8CBE817877C6AFCF7FA0774A76451D2D5F7AF7FA1A96344742FE60EEA871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/FBBw-Gs3OJaD6yd94ZVHEm63jV7wMzv3MiXtHvKDRIn9azlRWLR3FJHuk-zRXV5guMDl=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ....0....*..(.>i(.E."!.[..@...6........F3=Y.t..~....O ...O....k..v.../...}......+....p.._...r=.~.z......{.....g.G.w.........{3~.....zu..|5.t.....u...........x.......S............3}....W.....'...#.....|..M..._......o}....N..W.w..j...O........./.....v.`?.?..............u.........?..o~..........._........y......l.....~....w.y......F...7^.e[..@Mhl....o...Kx.ez....D.^...Kx.'y~...=s(nr.<..{.3g.)..3.e.j.u..?h".P5J%G....v:...)`..xD.#!.H..cv.Z.Q....Y9.mF....h.-....rSX..j3...-m^..n....[......R.z.........u~....nB....!(I.S.V.x.:..=:.(..h...`.\...jE79..-$.~R.a..]m.....k./..M.....[z..4(...cvu.. .CEU.$..w*.f...f.Y.l'r.r/S.Yh..G-,.Ew~.u.*.C...]ynF.?...8.l+X2}^{p...G..2.R...........:xrHW.zU...@{.b..w...?].........-..'.....?.W.S.t..z.e....h..L.0.^....uq.Q.p z...8r.I...v3......9..K"hC?.../q....~....!Q.../..q..............5.Z....V$=...u...J`[8..;h.....l.;..W.b.{.W).W1..E.D....../...1i..}....C.).9....[y.`.....Dno..D..qC9.....E...p.*d......Z*!.p(T.

                                                                                                                                                                                      Chrome Cache Entry: 449

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):13
                                                                                                                                                                                      Entropy (8bit):2.7773627950641693
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:qVZPV:qzd
                                                                                                                                                                                      MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                                                                                      SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                                                                                      SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                                                                                      SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://td.doubleclick.net/td/ga/rul?tid=G-9232N9ERWJ&gacid=1533494344.1727546622&gtm=45je49p0v9134485199za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&_ng=1&aip=1&fledge=1&frm=0&tag_exp=101671035~101747727&z=1451000537
                                                                                                                                                                                      Preview:<html></html>

                                                                                                                                                                                      Chrome Cache Entry: 450

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):40532
                                                                                                                                                                                      Entropy (8bit):7.995619656406213
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:k/huNy3xHHS61C7DLFLn2XP384ueY4QKf9roJ+nlwa+z7cz6Q5pmxuP8mh9:kgy3xnz1kpz2XP3yEN9nnSa+vW15oxuv
                                                                                                                                                                                      MD5:581F3D3D49460D70B7727752C3339F13
                                                                                                                                                                                      SHA1:C70220D89F25E1310C2180F280920414A94208B2
                                                                                                                                                                                      SHA-256:B1C9E778A9253BFEC9874245823B23EE8C5BC40D131FAB451F33920EB418E145
                                                                                                                                                                                      SHA-512:020FA8BCE423A980065B7FC72CC61183791FC8A472BFE6B5D077580D787050EBB030F98D6C456DEFE6B1F2CF7B23C76CFA487A1BF3290814EC6BF11C8A7E8C20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/vwJsDXZ-Czy7hTp6ODjPieE0hvOdvAmvoHzD9yg1myUoWrPIocXuHfo1GCTF43NZh5c=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFL...WEBPVP8 @...p....*..(.>m*.E."!..X.....fm..#..(..\.r......|..O...~..........?................S...w.O.?R....._.s...|.........w......................K.G.G./.........?..g........i.#...........{......g.K.s..._.}..a.....?/...!.g...o..._..w..|{.Oyo....G._............z..7...../....z..3...?.?......s....._..&...............>B...u...?.O.?..n.......%...........mk~...9.T.......).g../..6{.!.[.."J.o..V.':0.N.{.*......ol.5.........g...y.../ .74..F...8,_.l...i..]hY..!.ky..Y6..9...F.;..e...7!n.?.........i....d...%g{1I^4...,..B.......^..G.l..2._.V...t...5.P.{..........U...K.... F..bG`.h.}l`.......:...p....9..w.V.p..]..........g..}U..I.N.b.w....l@.........j..0........Qq.W.vlG$...Q..... .]..[.+.....D.......0.....h8....#s?.n..F...0...;. L.......2-.x ..../xzY[..J..q.....(..oN.6..p.-....w......).)!i..P..a...F...{ :.XL.S......b=.VD......q.....}......P.|.)76.....:l...Z.+.\./...d.0..L.T......m..U.....v.o..<....KL..{.<..).X./u..f.V&v.]."Um..."s]9.T.....l..L...

                                                                                                                                                                                      Chrome Cache Entry: 451

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 260 x 76, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8766
                                                                                                                                                                                      Entropy (8bit):7.933920822258876
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:WdyyHvy2mO9Y8W06wUc805X/Y6evLGdIZTNrIUF9sBIxcna0CHB:iygvk8F6wPgjvmIZZ8UHsyxc/gB
                                                                                                                                                                                      MD5:9E67214F7F65B87E52768F3D483ADA89
                                                                                                                                                                                      SHA1:1B819AC0B7DF6D353716DAAA09E7C2CC69B503E8
                                                                                                                                                                                      SHA-256:5451A6239062CB5CD5A9C3E6F63174B6F0AAF1600A76FCD8A130F86DC179F543
                                                                                                                                                                                      SHA-512:A36537538FC0D29D07582E31B0A7487D93FD89572F0CC857148C37F8F7269F4DC9D9A732BB3791D66754AF146D8C17B8876475892443EB8291DA53F601DAE3E7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR.......L......t.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Fireworks CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DA98CBE2ADF111EAAA68D833C047B06C" xmpMM:DocumentID="xmp.did:DA98CBE3ADF111EAAA68D833C047B06C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DA98CBE0ADF111EAAA68D833C047B06C" stRef:documentID="xmp.did:DA98CBE1ADF111EAAA68D833C047B06C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8.1.....IDATx..].|...?.).H..C.....". MA,OA..P)V......bG.......HW!(..D@z.." .. .^6.~...Y.L.&......7dvvf..sO?&..y..d..7.

                                                                                                                                                                                      Chrome Cache Entry: 452

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3510
                                                                                                                                                                                      Entropy (8bit):4.770486597891659
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:+Y+42e/FkkR72e/Fkk+K2e/FkkR2hJ2e/FkkbA2e/Fkke:xtqk5tqkPtqkR27tqk0tqke
                                                                                                                                                                                      MD5:6795128E5015F4412BF87C8909466668
                                                                                                                                                                                      SHA1:C195835ED321A899A05ECB2941A1EE9B600834AD
                                                                                                                                                                                      SHA-256:8C44954F53BEA7A3F7C31D25AB0881E1A1787421FC3B6EF7D0164344AEC38BF4
                                                                                                                                                                                      SHA-512:FC6110EB88F842E6CEE83818B2D02EB0944CEF292471937A42EEE1C1DEBBDACAC4837D8B3E7EDD44B252EF0A55C1A9E04DD282255DA7FD3DDAF704F9134ACB71
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="127" height="30.003" viewBox="0 0 127 30.003">. <defs>. <clipPath id="clip-path">. <rect width="127" height="30.003" fill="none"/>. </clipPath>. </defs>. <g id="stars" clip-path="url(#clip-path)">. <g id="Icon62" transform="translate(-802.284 -421.325)">. <path id="Icon" d="M810.667,435.627,806.212,438a.572.572,0,0,1-.778-.245.593.593,0,0,1-.058-.371l.851-5.03a.589.589,0,0,0-.166-.517l-3.6-3.562a.59.59,0,0,1-.01-.826.574.574,0,0,1,.33-.17l4.98-.734a.577.577,0,0,0,.434-.32l2.227-4.576a.572.572,0,0,1,.771-.265.581.581,0,0,1,.262.265l2.227,4.576a.577.577,0,0,0,.434.32l4.98.734a.587.587,0,0,1,.319,1l-3.6,3.562a.589.589,0,0,0-.166.517l.851,5.03a.584.584,0,0,1-.47.674.569.569,0,0,1-.365-.059l-4.455-2.375A.57.57,0,0,0,810.667,435.627Z" transform="translate(0 6.259)" fill="#ffbf29"/>. </g>. <g id="Icon62-2" data-name="Icon62" transform="translate(-776.284 -421.325)">. <pat

                                                                                                                                                                                      Chrome Cache Entry: 453

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (2343)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):52916
                                                                                                                                                                                      Entropy (8bit):5.51283890397623
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
                                                                                                                                                                                      MD5:575B5480531DA4D14E7453E2016FE0BC
                                                                                                                                                                                      SHA1:E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
                                                                                                                                                                                      SHA-256:DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
                                                                                                                                                                                      SHA-512:174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var n=this||self,p=function(a,b){a=a.split(".");var c=n;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r||u();v=v||q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING||[];w.TAGGING[a]=!0};var ba=Array.isArray,c

                                                                                                                                                                                      Chrome Cache Entry: 454

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8936
                                                                                                                                                                                      Entropy (8bit):7.956907587624483
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:/DjXNwZH5YtK57zpLJ2wNL9UTREmszGjxf/PnhGkK6/olOaf5mONWuH:/DbM5Yk7t0wNxUVjFnhY6agON1H
                                                                                                                                                                                      MD5:04F069E71A745C59E6F9923DB1F2E1AA
                                                                                                                                                                                      SHA1:24A6DF876079A5400BBE5A01B9D9B5EB466969E5
                                                                                                                                                                                      SHA-256:DABAC5AFD05F5138FD5936ACEA8160DE1A18EAE341CC8AA619F998399AB0475F
                                                                                                                                                                                      SHA-512:8CE535D1D167CC00088586BDE47DBAC44E02643A318030F559646A2CF2F46E8AD513EFED79814DC57B516D7F91A949B2D8096FB6EB44090D72E4137F2281FA33
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF."..WEBPVP8L."../?...M0l.6.........#"....}..F-...p...[.".]0L.H...r...B.K.:.F...|.c.".....G:...(.....k....P....g.hB.0...a}...[F..........\.._..Y,.~.`.6.3......W..R..M'.t.f.ps|.']I $j.6/...YV.-..F.....gX.~.c.m.!I..=OD..*.......h9...z_.m.m......m..Y....f..C./l..;.m..<K../.h....m...mL.S..L./.Iw..d..N..hm;.h.u]...BW..T;}.m.m.m.._.}]..V.HRI...m..m...>..oX.....P......c...g@..D.sFq..v..}k.Z!...P..@".@b.)...HB!..... ..U.5....u-...m.b .$........."....Ee..60..iT.5[d.......0..C3.....I.f9.<......t..f@...$..@...)...5.I..D%.."....Z6.[V....Z..<..e...~..l..B.B.5..t&.h..*H"K......+Q<...4\.....IAR.s.,...........aMs\....a6...<...GNI.....D.BL...U..k..D...QBh..P......"..E....h8`HJ0..P.".c..o..2.9.3\sH..`,.L.$..`.x.=...}.r..=......w8.l.....W.....W......1.A*. .....B......@. AR.......Hj.BhZP,.....A.LAP.@,...o...h.@m..p......Q..)da.QUPg........Ez.|3].\OOVO.......a..?pbm}.e.......l...D$.....3.0. ..4..H.]B%. .p._.(!I.&.E.._?..Q.5P..2L......@..%.R].;CO.......

                                                                                                                                                                                      Chrome Cache Entry: 455

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):65181
                                                                                                                                                                                      Entropy (8bit):7.996465248232353
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:1536:i4wkyt2BC1yQiFHKdIf10goL1UOlFWoQJsOtsB2CdVoLraB:i4PG2BdBqOtCiOlFyxtbCoLraB
                                                                                                                                                                                      MD5:8631B3F870ED55DF381A7F1C2F64CFBC
                                                                                                                                                                                      SHA1:92F5C14BDCF002E768B46A34FED64159377E3E50
                                                                                                                                                                                      SHA-256:18CC5D89DC56537C85BADBF7F05910B6CE5A8B2F0F90856F5D2F6E15995C2F4C
                                                                                                                                                                                      SHA-512:59FA5286699E5428019C7A2C224308503BFC59144F245DA7A1532633CE83347C020E6C89B60430E612FC80266B31505E9D79B673037560D741968981AB08FC00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/index-banner-2.webp
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............ALPH}......m.0..w.i[.......@;oR.1.h.6m...l.1=..m.m,....m.1.m..[.%.P[.....T(c...X.lE.....9..d...I...*$.M.'kv.".p....Fn.F......Hf9....>......:.?..K.V[w}/.z.?@..}......z..|.[..........;~....z.3.....vIyoOo.i.c{ZF...MW5.$V{...Zf..4..^:X.;..U=.Q........LO..Cg...<b.6.....7M...P6!U....s?7l....?v..o..D)..tq. R.(.%j.Y=...j.i..w.1.j%....j.H....M...,5a,..2....V....^.Z..0v.X5..IL.R....../...(......d3s...P..5.v..u_=...t..$3.3.."F.n..p..Y.hF...m..K]e.#......M.F......1o..r....%P.!.HF......F.).....iOf..1Uu.x....:?...(.V..Q...iV..<[..+UD..i.f..1...L.}.P)7Zgn......b.w.......PC.=...e.JE=..>."......[7h.....LY.@9{.v...th..R..!.q4.\.Z.O.O........S(||..|..z6.......w..fq.".Z.... )q.....A..o...u..a.u.M..i5[..dq.k.......|o.G..G.MZ..Q..9.!...=TutT....r.A?_...?..@......V.p..}}E..s....O$-.=}f.[..v4.#-.<..(...V..EE8a5..(.......^:....{J6..px..w.'..;..Rrd..x..n...a..wzH.*..."w.._.!.:.Jz<1|+..z......'....!.x.N/.v...W..)...g.rz4&........o..a.

                                                                                                                                                                                      Chrome Cache Entry: 456

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):20328
                                                                                                                                                                                      Entropy (8bit):7.992131068751189
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:384:R4okm0X6Y+804KjdONzEstklmZRMsisYRjmoZTYuC4Q9/BFEKM7nBl:mokm6VbqjwNz56QMsisYRjRZTY6eBKKS
                                                                                                                                                                                      MD5:58C7055FCACB604A63D4F123ACDD5A1B
                                                                                                                                                                                      SHA1:1A3BD7119F3F03A7BA59B3407375D1D420FA8FA1
                                                                                                                                                                                      SHA-256:4F6FA345B5584F355421C0D2635D8052855D69EBA61146342AA6DEBE4845A7E7
                                                                                                                                                                                      SHA-512:D0964BDD4C0590D6BF7D0D17BCC4845CB4DE7C0D24FFC54CE58ECBD799C08634AF25E85DAFA56559C755C44811897436F097C202108B802DC6E55B371535E463
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF`O..WEBPVP8 TO...f...*.. .>.@.K..&!.1j....gn..6.....>.8...x...O...g...y+.c.......z../...U.w./....P...?..n...[.........W./.w.....O.^...>n...../.^8.Y.'.}..._.k.M.m.O...?.{..'...?.?L{.{{..dv..'.......w.............'......?.."...C...O...Ov...p}.~....?.I<Q..R..i.GE..#...y.....#..v..t[..<..}.G..o.H.:-.i.GE..#...y....fm....Y.3#...>58..]..(.l\.;.6,.....U..:.d.D}..4).. ..`.TI hg@.yv....@...!#.:j..9$.#..TF..NCR.......23$..F..g.\.......U..3z2...'.0=..S....&...b1X.{K.G9.?g..B.L...x...x.U.9.S...-.R.h?.s.G3?..E..8...=S......t.....s...M.....?.y..\.lJ.k.-.Q.p%.*!....g_./6....M.....I.....{.....+...Y.^..w..9!AO/a.......P...d..m8......"l..-..X.d.F.c...V.B.J.V.a.b..G.6t...(..&2,...P ....u.V..........Tt[.6..t[..<..}.G..o.H.:-.i.GE..#..w.#...y.....#..v.8J...B.U.k...c...f.1....x.m,.6....V:.&./..(.x..........7...f.Y..Q...N`6$.....8.)>.....|.`...<....=....H..4.b!~.EfSz.9...G.E.D...v...gdN.....Li...}.0.bw.a+.......M.%...".r.....s.BH......n.~...)...Jo0...z..Zb[....A...

                                                                                                                                                                                      Chrome Cache Entry: 457

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8672
                                                                                                                                                                                      Entropy (8bit):7.9657826197851955
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:QxhfN+RkTxzurpYeoEkYqelM0WxpjQyyd5P8nJZpqhnCh7e6:QXN5zuOekYbbWxRQld5PsZQhnEt
                                                                                                                                                                                      MD5:4CEA15C604E63D3E7537324F34811098
                                                                                                                                                                                      SHA1:FCE3E1380CF11F7F3318D857BC9E4BAEE82D89FA
                                                                                                                                                                                      SHA-256:653EEE6AA0AE78CD5EF4FD2E3897D198A5422CC5F63F1F667ECEBBE692AAB019
                                                                                                                                                                                      SHA-512:6C3E0893561B7AB8474A3E526EED9B5503721B14275E0641351577D06AC60CD7B97A5F70107DB1D2B5FF682C57573A6E3F71A290B0000E0D522A407085BBB5CD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8X........?..?..VP8L.!../?.....n.."..#..UA...gC&../.*.#...X$_..N[.X8.l.v.z.mk.......>.`.I..y-.8.# .@..5....$........_kg.?.~..O..2...@.!.&.(t.\Q.;Q......b..yA.b...f.b.."SH)MPZ...P.dEV.y.._s..j>U.4..U}XR.:..Ws..U..3.....{Z..*4.b-.J..g..r...P...?.!"&@...N.#.Q@..`.v33........@...-/!..l!J..3'....)~...v..te:r..'......1.03....t?]Z.e....o.rCI.$..........y.0.4....4.N.....{.t..H....Zz....i..$...v..2&.....\K[.....M*I..\..j.m.6.m...k.NR.B.*G..=...{..hwg.YC.v....l~BO..m..lw.{d.....i.m;.S...&. ip..,0u.-.........L..]:..u.@....\.u../l..I..<..8...kZc...Z...Z.m..v-.ms.rufVfD..._L..Z..e.9..j.....dP".*.9..g.3g-.....\...+.]..m[U.y.}....i.R......."..H..h...6.....ev.9..;,?..'...7?.?.....). ..(.(@$@.@..W..0k.......m.*.X..c.......Rx.1L@.@.D.. 6..A.*.XV........b.YD....0=...j..6.<.(@.....".p.qj.V...:.}...8..K!.-$1*.. ...._.W.t ...4.....>.b.T..Y..m....L..d.....S.!.@P..KRAc..g..*. Ra2........o...zl....XN..>h..\d..F.Fn...i$.fI.i(.<.q:~u...jB..$A...Wk.XU}.

                                                                                                                                                                                      Chrome Cache Entry: 458

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 260 x 76, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):8766
                                                                                                                                                                                      Entropy (8bit):7.933920822258876
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:WdyyHvy2mO9Y8W06wUc805X/Y6evLGdIZTNrIUF9sBIxcna0CHB:iygvk8F6wPgjvmIZZ8UHsyxc/gB
                                                                                                                                                                                      MD5:9E67214F7F65B87E52768F3D483ADA89
                                                                                                                                                                                      SHA1:1B819AC0B7DF6D353716DAAA09E7C2CC69B503E8
                                                                                                                                                                                      SHA-256:5451A6239062CB5CD5A9C3E6F63174B6F0AAF1600A76FCD8A130F86DC179F543
                                                                                                                                                                                      SHA-512:A36537538FC0D29D07582E31B0A7487D93FD89572F0CC857148C37F8F7269F4DC9D9A732BB3791D66754AF146D8C17B8876475892443EB8291DA53F601DAE3E7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/android-app-icon.png
                                                                                                                                                                                      Preview:.PNG........IHDR.......L......t.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Fireworks CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DA98CBE2ADF111EAAA68D833C047B06C" xmpMM:DocumentID="xmp.did:DA98CBE3ADF111EAAA68D833C047B06C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DA98CBE0ADF111EAAA68D833C047B06C" stRef:documentID="xmp.did:DA98CBE1ADF111EAAA68D833C047B06C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8.1.....IDATx..].|...?.).H..C.....". MA,OA..P)V......bG.......HW!(..D@z.." .. .^6.~...Y.L.&......7dvvf..sO?&..y..d..7.

                                                                                                                                                                                      Chrome Cache Entry: 459

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1618), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1618
                                                                                                                                                                                      Entropy (8bit):5.781837534694755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:VKEcJHxKo7LmvtUjPKtXsNEHFmc8s1aiRLrwUnG:fSHgj5c+HFbHv5suG
                                                                                                                                                                                      MD5:94943530E104EE3F88D6AD86638B28C3
                                                                                                                                                                                      SHA1:B8B7F7556523E03B5519338B59AE8D998987D457
                                                                                                                                                                                      SHA-256:2538181A77FD5AEA93113400E39EBA98728EAC1FC13057F0B40C9AAE69054EA1
                                                                                                                                                                                      SHA-512:5031C94E34477D67FAC9002DE62BB81CB359B16B59FAD19EB63CB1221ADFC275AC956F25580BBCA5D5F829FCBAAA4161F59302C584635E8D30217D3492F5D4D1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.google.com/recaptcha/api.js?trustedtypes=true&render=6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0
                                                                                                                                                                                      Preview:/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]||{},N='grecaptcha';var gr=w[N]=w[N]||{};gr.ready=gr.ready||function(f){(cfg['fns']=cfg['fns']||[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']||[]).push('6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!

                                                                                                                                                                                      Chrome Cache Entry: 460

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37658
                                                                                                                                                                                      Entropy (8bit):7.994897732347311
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:TcLp/YW4i3iSAv1E9R6rYhOsr+yP/xImd8BIB01iP8mks18VK4y5:AGsFAvwgrjYNPqmhua0K46
                                                                                                                                                                                      MD5:7090B63ACBEC7EE45513BDDC66AD4830
                                                                                                                                                                                      SHA1:08DC4311CA095FEA0628CC8A8123DE300C6F084D
                                                                                                                                                                                      SHA-256:41799BFEFFBEFD1B0A4EFC6AFB98EB7BCFC96319A00DC81A9896942738ADDC2B
                                                                                                                                                                                      SHA-512:59CDDAFDFE470FBAE2D08B1DEADADA9CAAAAC576B5E06797A82E4B65FADCE9B845EB9F89F87FBCB632E39AD79774B939E16D710D145769AE3726F8BEF663C6C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."..j.@.D.5x.C....#. DH..3,..g.. ...>p....>..k...|W./5.......W.............../..'......J~...{..........o....._..z=.?......Y...%...k....?./l................4?U.s..w...q.S./7}.}#..........!.#......}..._..............{......?....9.#...............}d.C.............?........?./.............O............#.....?n..}K...............E.g......g.....?._.??.;.0|..Uy..m.u.W..{..9"c...sl....(..&....N..f.....X.rXu.L?m.Z.z......bt.sO.R.9......;...K=[Q?...e...T=z)..D/..L6..Z.........X5Y..1...ir}.T../.,J.F..Z..x,;..YZ...,...\.d4..}...n...s....(...z...D.G.j.Qo..0...u.%Zp......K.......!..(..Ew...S...)EVP.*].....y[..!.K5.Y ..T....'....G...`.h....4.z.d.5[<.".#.#...;..#.y.....f....c.....ZW..."...U..#....\<n?.{b....{..qQ..B.'.O$v...L$^h.U..........Rc...6....^4EwC.`>r2.C%.oBL|eG....[.Z..F.e.....ov.J.[O.\..Q".....!..5.....3../A.k./X.:L..5..e2....?%...?/e...,...D.IJ..gs....z.............P$.Jw..T.......ra..).../.._f8.h.\....

                                                                                                                                                                                      Chrome Cache Entry: 461

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (8117)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):141508
                                                                                                                                                                                      Entropy (8bit):5.721104481077863
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:qx4nQ3RLiR0Cms8miAxrypVrCVNPNWY7a3b9483E/jh7:bnQ35GO6VNA483EB
                                                                                                                                                                                      MD5:E364F795240176A03C01B24E2BB6C7D8
                                                                                                                                                                                      SHA1:13A831757E3AFAC2590CBA963FF21179141ED262
                                                                                                                                                                                      SHA-256:5BF67AEA42369ED0078F677FEAA550B1BD9FBACED40FE85F14141DF5093C211D
                                                                                                                                                                                      SHA-512:2BB3AEA5DF5461E812D0E8D2C1D78B4FAC81630F02E107A63E97CB561810834ECA2B04DDC0B12096A570420EFEFBC63B771026CCAC7DA0F587F0DD3B10F031DD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,EEDORb,EFQ78c,GkRiKb,IZT63,IcVnM,JNoxi,JWUKXe,KUM7Z,L1AAkb,LCkxpb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PrPYRd,QIhFr,RMhBfe,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aW3pY,aurFic,byfTOb,e5qFLc,ebZ3mb,fKUV3e,fl2Zj,gychg,hKSk3e,hc6Ubd,j9sf1,kWgXee,kjKdXe,kr6Nlf,lazG7b,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,n73qwf,ovKuLd,pYCIec,pjICDe,pw70Gc,s39S4,t1sulf,vrGZEc,w9hDv,wW2D8b,ws9Tlc,xQtZb,xUdipf,yDVVkb,z5Gxfe,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=vNKqzc,fI4Vwc,sJhETb,JH2zc,tBvKNb,soHxf,IJGqxf,wg1P6b,ywOR5c,PHUIyb,BfdUQc,oEJvKc,kJXwXb,chfSwc,aTwUve,indMcf,pCKBF,RQJprf,lpwuxb,NkbkFd,nKuFpb,zBPctc,jX6UVc,qfGEyb,fdeHmf,SWD8cc,tKHFxf,rpbmN"
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".H1RBrd{max-width:500px}.UIeOBe{margin-top:30px;min-height:120px}.k2cXo{margin:0}.XWz5yd{margin-left:160px;padding:0 20px 20px}@media screen and (max-width:480px){.XWz5yd{margin-left:0;padding-left:0}}.iCVHHc{height:215px;text-align:center;width:160px}.FOYkDe{max-height:215px;max-width:160px}.Dtwbxf{font-size:28px}.Hv8szf{text-align:right}.rYrxJf,.rYrxJf:visited{color:#00838f;padding-left:3px}.F9JOfb{margin-right:3px}@media (max-height:fit-content48px){.ZDGq3b .VfPpkd-P5QLlc{max-height:calc(100% - 48px)}}@media (min-height:fit-content48px){.ZDGq3b .VfPpkd-P5QLlc{max-height:fit-content}}@media (-ms-high-contrast:active) and (min-height:fit-content48px),(-ms-high-contrast:none) and (min-height:fit-content48px){.ZDGq3b .VfPpkd-wzTsW{align-items:stretch;height:auto}}@media (max-width:528px){.ZDGq3b .VfPpkd-P5QLlc{max-width:calc(100vw - 48px)}}@media (min-width:528px){.ZDGq3b .VfPpkd-P5QLlc{max-width:480px}}.ZDGq3b .VfPpkd-P5QLlc{min-width:calc(100vw - 32px)}.ZDG

                                                                                                                                                                                      Chrome Cache Entry: 462

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):23002
                                                                                                                                                                                      Entropy (8bit):7.989222180586788
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:assSIk/cjTjX/5VBfQuAPTQ0PA/Kurja29q2PhOioaJ+wC5retZ+:asfIk/InXQ0pr2oFPh/T+warIM
                                                                                                                                                                                      MD5:D36D407070A371FEC43C03A6DBF4AFA6
                                                                                                                                                                                      SHA1:D45A16ECCC9D498AB210F81FA2B9C13FE8CFCBD2
                                                                                                                                                                                      SHA-256:F50322D0A4BE4B75153E6FA1B56FD3B92BAD916238B846F8258A4BDEF2A1FD18
                                                                                                                                                                                      SHA-512:95F036157BB54E387C1519B48C828F69446E1B573802950F0D8721CE2AF6DE07BBC19719DCAED8D4F421D767AB44BD1BEBE7630B0ACE64B35927935DC86313B1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.Y..WEBPVP8X........)..\..ALPHb....`.6...2...{..{.4..%"&..\!..d.."m~.L.............?............?............?... ....tr.......%.VP8 JY..P....**.].>)..B!.......BZ[.]T?..)i........P.......@..oJO`......=.uB.=...S.7....~..r...K....#............7.....]p..........X...G.....|...H.K.'.O.?..?.]...}...W...._.......g.....?._P_K.7.o.W.....x~".........?!.#...g............R.........?....`...)..._.....v.....3.../....m...U.........|.........?..v.5.#.......?.?..w...;..._...>...~||..k.q...;.......u.;...+R.......@.Z..........6..N..a...+.....j.....Yu67=......]Q@..e...|.[....f|...-......Q...P....Zq.Y..\u....VU..w.B.b.V.f...;}...I.[|......W6.FgsX.Ia.6...tx9.L..;c.+.C.U.c..Pi.3.n.Fcn."<..i.....^~..S"......{.y.|.........z.}.7.'...i$.~..E.t........S+#T.;.&%.%O?.P..8X..!1P.~.....>*.!~MO...#._..p...=i./..}.s.,..m.).W....)3...#...M....dD..Q...E..a...._..=..jZ...DJe...8..<_..7...c.s........Ng.3.....9'0.ET.b.SH.m@M.x...[.\M..t.i.Y.p...Hg. ...9.7...L#s.....|.'..`.0a(.&>

                                                                                                                                                                                      Chrome Cache Entry: 463

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (2343)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):52916
                                                                                                                                                                                      Entropy (8bit):5.51283890397623
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
                                                                                                                                                                                      MD5:575B5480531DA4D14E7453E2016FE0BC
                                                                                                                                                                                      SHA1:E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
                                                                                                                                                                                      SHA-256:DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
                                                                                                                                                                                      SHA-512:174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.google-analytics.com/analytics.js
                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var n=this||self,p=function(a,b){a=a.split(".");var c=n;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r||u();v=v||q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING||[];w.TAGGING[a]=!0};var ba=Array.isArray,c

                                                                                                                                                                                      Chrome Cache Entry: 464

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):49
                                                                                                                                                                                      Entropy (8bit):4.379417496911518
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:YGKAAGYFhLiRMl4n:YGKAloIRMl4n
                                                                                                                                                                                      MD5:2DF439D118EA79EB03897DF8F13E2332
                                                                                                                                                                                      SHA1:D72A92741A6A079E288395119ACA08E08EA13C1C
                                                                                                                                                                                      SHA-256:4D65AE7371FD9D4CB23F83609A49535925DE39E8C4A2D4C87CC295C30FDEED93
                                                                                                                                                                                      SHA-512:3F8840B914C99665948840618412B0E8BF80D7A271A3C83A4A8A361C5A5B8B73B6B792578FDCEC36EE33D0C04ACA3C2E360A6529C090EAE20D79D0C7930BEBA0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:{"code":0,"msg":"There is currently no activity"}

                                                                                                                                                                                      Chrome Cache Entry: 465

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (9767)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):9878
                                                                                                                                                                                      Entropy (8bit):5.379210366392289
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:17AC3oipl7XNvFSTBv/CpvNE5qds7DKDTlxnnoT+eXhMKrqvwZpukR:17N3Z79gdqdsnK19oKahMkhZpukR
                                                                                                                                                                                      MD5:D067F0883540B1DDDA0E2C9AD1B14260
                                                                                                                                                                                      SHA1:9C3514916601F8EB3A45CD4A25F9FA040889D6BA
                                                                                                                                                                                      SHA-256:50A9333A7FF0D660714662CB1AB49EC81E1ED716EBA78C729600166F7338DA95
                                                                                                                                                                                      SHA-512:4B13B47307F18FF421817D52829994AF4536979DF4E1ECC656173400ED98C0E43F0BC3BAEF29F24E8ACC2868D5BF57C99CF4208DDC51CFAC7BD0C63DAF4B0AB5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/photoswipe/photoswipe-ui-default.min.js
                                                                                                                                                                                      Preview:/*! PhotoSwipe Default UI - 4.1.3 - 2019-01-08.* http://photoswipe.com.* Copyright (c) 2019 Dmitry Semenov; */.!function(a,b){"function"==typeof define&&define.amd?define(b):"object"==typeof exports?module.exports=b():a.PhotoSwipeUI_Default=b()}(this,function(){"use strict";var a=function(a,b){var c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v=this,w=!1,x=!0,y=!0,z={barsSize:{top:44,bottom:"auto"},closeElClasses:["item","caption","zoom-wrap","ui","top-bar"],timeToIdle:4e3,timeToIdleOutside:1e3,loadingIndicatorDelay:1e3,addCaptionHTMLFn:function(a,b){return a.title?(b.children[0].innerHTML=a.title,!0):(b.children[0].innerHTML="",!1)},closeEl:!0,captionEl:!0,fullscreenEl:!0,zoomEl:!0,shareEl:!0,counterEl:!0,arrowEl:!0,preloaderEl:!0,tapToClose:!1,tapToToggleControls:!0,clickToCloseNonZoomable:!0,shareButtons:[{id:"facebook",label:"Share on Facebook",url:"https://www.facebook.com/sharer/sharer.php?u={{url}}"},{id:"twitter",label:"Tweet",url:"https://twitter.com/intent/tweet?text={{text}}&url={{u

                                                                                                                                                                                      Chrome Cache Entry: 466

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1527
                                                                                                                                                                                      Entropy (8bit):7.052183572825318
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:F1hmYaWwjx82lY2T3QvVwqyJ3VI6BGYA2wVE/ThRLg2In0OPrnq3BQxDn2/9kb:rMYLNn2Mv8J3T/ANVEPLcnjPrnj2ab
                                                                                                                                                                                      MD5:27CFA369283BAA8A6339815EC2728FB0
                                                                                                                                                                                      SHA1:B7FECA078CE0F57384843109704054B19545C2D7
                                                                                                                                                                                      SHA-256:1CAAD2497915F2A5CE0640CE769EB883A942A25652A5AD3E69C077885A4D3894
                                                                                                                                                                                      SHA-512:E3A19C1B2158D62177A0A11C3D4922384A23CEFE594A97EE82A9634E2AF8A21BBF11D2862C369B2588414C34E8C78E2A3C26D03C218748C087715ECFFF4805BA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:3C280707A22411EABE3FA987F0B8798B" xmpMM:DocumentID="xmp.did:3C280708A22411EABE3FA987F0B8798B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3C280705A22411EABE3FA987F0B8798B" stRef:documentID="xmp.did:3C280706A22411EABE3FA987F0B8798B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......eIDATx..Y.K.A.vk.2....PR.Y......k.).t..(.... A..t..n..V.A...u...F...7....w]..5..3..}.....9Q...,=...F.

                                                                                                                                                                                      Chrome Cache Entry: 467

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):164
                                                                                                                                                                                      Entropy (8bit):6.560027690474973
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:u1Zrql17vRGlYo0Dr9TpkNTF3N9aQgn+39IzWIkYutRCv3hCEKX/n:u1Z+l17vRGMhuRT9p3WzWeutkvRCEKvn
                                                                                                                                                                                      MD5:C3D7960132B3DA262B721E88CFB2583F
                                                                                                                                                                                      SHA1:1612089211858694E09F6F715F3A0B4145DBA674
                                                                                                                                                                                      SHA-256:DE88165FA4D58B4AD531B6F8D8FACBC5DC00F73E96B617E503D36FEE29C53CEC
                                                                                                                                                                                      SHA-512:F18E3F59F71CF7521938C90826FDC28BB7F3EF43749C4DBC48F46FD6FA1B293A58461B50E021B7569F4EDD55B5129C4755E61E3D4F1205B7535F5A572A6EBE45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../.......$)...M.=.X.~..Qm.J.....@.Z.......{...m.FiS...`..V..l&Z*. "...V..(..N......c..eLp..@..+..$..;.3......D.&a;|...H..R|;..3..#XD..UR..>V..

                                                                                                                                                                                      Chrome Cache Entry: 468

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 260 x 260, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5564
                                                                                                                                                                                      Entropy (8bit):7.797375274577943
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:IYR2MGg+Hp1tdVGgEBt1k3T0WHDPYQIb7v5aRKoMEzXJ:5fGTJDGg4k3TUoRKQz5
                                                                                                                                                                                      MD5:658707BB47727B9885675442178C7732
                                                                                                                                                                                      SHA1:5C64187858C53F7621377B27D1B08FE0C6251569
                                                                                                                                                                                      SHA-256:01497A304BBDCC2E2D7621E5F27AEFA1ABCC929C284CA94D7C06514DD950418A
                                                                                                                                                                                      SHA-512:5EA5908996322EB4D38D95D32B8996706B90F25372CEEB4FBAAC2FC5F2E146609AFD04E0327801434E30B08DFAC6366C1FB4D73D2F4B5CB62488A717F061EBD6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR.............Aj.]....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:F174243DC00311E982EAD97732B44099" xmpMM:DocumentID="xmp.did:F174243EC00311E982EAD97732B44099"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F174243BC00311E982EAD97732B44099" stRef:documentID="xmp.did:F174243CC00311E982EAD97732B44099"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O.....*IDATx.._..U....so...V.P..b..&<..F..#..o..x....| 1.@|3.'.O.....Zc.D...,E iJ..i{.w..9..93..f.9.[..

                                                                                                                                                                                      Chrome Cache Entry: 469

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):14488
                                                                                                                                                                                      Entropy (8bit):7.877375184944868
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:i+nkZheKRIwrm/a48si3/C1UKkb/0XUTkxXqDB/8:i+nkZIK+wrm/mP0K0XWdN/8
                                                                                                                                                                                      MD5:4544570A922C51E96CB2F1BB67A0608E
                                                                                                                                                                                      SHA1:ED99AD69140AA35B702FFDC6E0AABB78F529E18D
                                                                                                                                                                                      SHA-256:B1A9CA2D487FBA3195C3B53218A97328A31C10F45686550704957A8913BABB87
                                                                                                                                                                                      SHA-512:A79079CF4B0E3FA0B91F61C0AF75DA7F0E947B09FB0CA9D7FC2ACDB5E2A98604B7AE78EBBAD6AF3DF95D8FA54EE970DA1D64770384A1A273311A81D7B5B13E20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/3mkmZHd6xK8/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF..............................%%..""%%%%..'10-'--5=PB58K9--DaEKSV[\[2AemdXlPY[W......./..0W?57WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................C.......................!..1AQ..Raq...."2B...Sbr..#3...Cs..4....c................................(........................!1.AQ"2a.....q............?........................................................................................................................................................................%...=..5.. %...=...X"._@...>... %...=].CK.@Z..Od.......7.ib..],......~A....o.l..t...::|c....d...........'.<.r..D..#.._..)....`7...G^.....z..T...|2......./..:?...9}..u.....I.s.?gFu........_yC.O.G..1.yC.O.Nk....5......1.yC.O.C.........7.................."?.....?.5...M.q.s t..V+.G.O.F.......S....n?.G:......m.k.m..g..q.7.U.O.m.K......<...S.y.#[3.M..Q..E.y. .c......YH..hy..5e..g...U8...9>.,....<...S.9.!.?....^z*...~Bt]N1......e /-.S.y. .c....... ].c...

                                                                                                                                                                                      Chrome Cache Entry: 470

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):20150
                                                                                                                                                                                      Entropy (8bit):7.9615289884912
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:X6QOkn5awMPC+Kqm4Ie8R3xxsSZsXi3EolFUplVJgmh5KW:XhOkwWp4msXi3EmUphVh5KW
                                                                                                                                                                                      MD5:71B4A36AE4E97644E908AB316B53D437
                                                                                                                                                                                      SHA1:102DD29C1FCE0CB165C3EB93425E5EA4BE793274
                                                                                                                                                                                      SHA-256:6992E8AC80458599555714A05BF285401506E05E32C104E854ADE6D3B7A516A2
                                                                                                                                                                                      SHA-512:8AF9A5B3F88E9D60BCC5421D6289AEB4B36D748F74D39AFA20A0A4AC2BD81B72A767546CE23459C15DA61D54A4B9FC9D900C11750B31FADF5E1C257749236C3D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/WOxi5lnDshM/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF.............................#*%#"""/-/)//'10--/-5=PB58K9--EaEKSV[\[2AemdXlPY[W.......0..0WB8?WWWWW]WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................@......................!..1A.Qa."q...R....2B....#b...3Sr.Cc.$...............................-......................!.1..AQ."2aqR......#.............?......!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@...G.x.z...s.6..8.V...~D..c...b.B.&C.U%.3.cS.L~..}.?......}.q......f...S.J..Z......JIf.{at#Bz}..{..].P=..{..].R.N/..HD....Wh..Z.d........a.'...j..y".b.&..v..u6...~J..#....)..'/#.t.!B}.K.....~.}..{....d..l#..$!Bz}..{..].W..rc=!.~.(..-&Z...N.U.sK..0n~......=O.S..F.&..;....&...p.~..(...].<.].9!J.1.*Lf.9.7.?...N.6.,.!.7......Xf.a.....@.5....~.}H|......W.g..a...P.*.......q.3............H....*...f.Njv.~.y..e....6

                                                                                                                                                                                      Chrome Cache Entry: 471

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):10400
                                                                                                                                                                                      Entropy (8bit):7.950295650853193
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PdLaTWs1PrsSUYgo5esYVivV1fIn6HH/Dn6GJrMR+:VLeWsmS3go1YMvnUuT6qYR+
                                                                                                                                                                                      MD5:89F750A76B87925ADC2A571AD384CCCC
                                                                                                                                                                                      SHA1:29D96B133E9F843B338DF410BE4D8BB0E4D2E28E
                                                                                                                                                                                      SHA-256:901CCE97A33F05FCC89109F6DD14BD3F141DDDDD6CD669AA2E6E9CDA252FCB59
                                                                                                                                                                                      SHA-512:FF337093D3B563BEFF868BBA755C45C6A81ACD2BC276123DBFEB4C22B9D8DA62850CBFED2961A3D8A8B6CF2AF359BC5FCDA8A4E4E69FE25A6B2E1ED9963E63B0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/download-logo.png
                                                                                                                                                                                      Preview:.PNG........IHDR...x...x.....9d6.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Fireworks CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DF5ABB86A4A211EAB05FA6B755E57B72" xmpMM:DocumentID="xmp.did:DF5ABB87A4A211EAB05FA6B755E57B72"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30D3167FA48411EAB05FA6B755E57B72" stRef:documentID="xmp.did:30D31680A48411EAB05FA6B755E57B72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....%.IDATx..}..\.y._.wO..."i.4..H...>...vx...}....8...b.1ILHb..g..~........<b.j..`.&.$$!.i4...uO..7..{....=.zDT:...

                                                                                                                                                                                      Chrome Cache Entry: 472

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):23002
                                                                                                                                                                                      Entropy (8bit):7.989222180586788
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:assSIk/cjTjX/5VBfQuAPTQ0PA/Kurja29q2PhOioaJ+wC5retZ+:asfIk/InXQ0pr2oFPh/T+warIM
                                                                                                                                                                                      MD5:D36D407070A371FEC43C03A6DBF4AFA6
                                                                                                                                                                                      SHA1:D45A16ECCC9D498AB210F81FA2B9C13FE8CFCBD2
                                                                                                                                                                                      SHA-256:F50322D0A4BE4B75153E6FA1B56FD3B92BAD916238B846F8258A4BDEF2A1FD18
                                                                                                                                                                                      SHA-512:95F036157BB54E387C1519B48C828F69446E1B573802950F0D8721CE2AF6DE07BBC19719DCAED8D4F421D767AB44BD1BEBE7630B0ACE64B35927935DC86313B1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/image_more_5.webp
                                                                                                                                                                                      Preview:RIFF.Y..WEBPVP8X........)..\..ALPHb....`.6...2...{..{.4..%"&..\!..d.."m~.L.............?............?............?... ....tr.......%.VP8 JY..P....**.].>)..B!.......BZ[.]T?..)i........P.......@..oJO`......=.uB.=...S.7....~..r...K....#............7.....]p..........X...G.....|...H.K.'.O.?..?.]...}...W...._.......g.....?._P_K.7.o.W.....x~".........?!.#...g............R.........?....`...)..._.....v.....3.../....m...U.........|.........?..v.5.#.......?.?..w...;..._...>...~||..k.q...;.......u.;...+R.......@.Z..........6..N..a...+.....j.....Yu67=......]Q@..e...|.[....f|...-......Q...P....Zq.Y..\u....VU..w.B.b.V.f...;}...I.[|......W6.FgsX.Ia.6...tx9.L..;c.+.C.U.c..Pi.3.n.Fcn."<..i.....^~..S"......{.y.|.........z.}.7.'...i$.~..E.t........S+#T.;.&%.%O?.P..8X..!1P.~.....>*.!~MO...#._..p...=i./..}.s.,..m.).W....)3...#...M....dD..Q...E..a...._..=..jZ...DJe...8..<_..7...c.s........Ng.3.....9'0.ET.b.SH.m@M.x...[.\M..t.i.Y.p...Hg. ...9.7...L#s.....|.'..`.0a(.&>

                                                                                                                                                                                      Chrome Cache Entry: 473

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1677
                                                                                                                                                                                      Entropy (8bit):7.1663617929645085
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:rMYLNn2Mv0jJ3psiGSkYsOYQ2qd+UWfsc:gYR2MsAX9k2qded
                                                                                                                                                                                      MD5:C0AE4497D95E0AC5D000378425DA1161
                                                                                                                                                                                      SHA1:5AC3393939386D7B78E4D7CCFAA95EF011931F5C
                                                                                                                                                                                      SHA-256:FF9CDCF1328D8825C8D6945C60333A665A1BC10087E8470DF3F29C6589E8FB2C
                                                                                                                                                                                      SHA-512:7F27A45B995E1B41A2DCE45E3DA399A6F18A13E5310407C0EE3AD05C7D99C5F017CC8543B3580CD0351A55CDB73A7E913F84AB49310B0524308F3DE66C6E874B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:42CAA64EA22411EABE3FA987F0B8798B" xmpMM:DocumentID="xmp.did:42CAA64FA22411EABE3FA987F0B8798B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3C280709A22411EABE3FA987F0B8798B" stRef:documentID="xmp.did:3C28070AA22411EABE3FA987F0B8798B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>).. ....IDATx..Mh.A...?..""E=.......ZP....S.z..$.k....\J.jk.E....^..I.6.."....X..;2-q..Lf7;Y...l'..3..7...N'.

                                                                                                                                                                                      Chrome Cache Entry: 474

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):16386
                                                                                                                                                                                      Entropy (8bit):7.982989558568567
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:JjNHgFUIQBL3AuODO64jjPUbWIjY5IZK3NDBk5z7xlvlUhY29XxEVdnlx4jm97B6:TayLQPO64kyIjxwexlt2Pi863zTi
                                                                                                                                                                                      MD5:4D8AB3ACE7A18CDCC2F2948C46656887
                                                                                                                                                                                      SHA1:2F7A1B9DC339182963254090126DBF1C33B524B5
                                                                                                                                                                                      SHA-256:33BD5D724DCC536558F07DA7B422497C193DAA2C16C6380C0D567B828242DF10
                                                                                                                                                                                      SHA-512:77BA8B2F3BD9A1B2036136F43E197473F69A0D706752ACB66875E71E33A3DC4D2EFA9469C86DC014220E1FD4BE0B0A81104E7CC1E5324765B3C2979778BBF3C2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/81v4o0GjDuXbmmSjGMrpMYDfDY0kxVICxt1aNmKIMtZTKnBY1hNYr09HUVY_4ovdcA=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF.?..WEBPVP8X...........'..VP8L.?../..I.5..m.i..S..3"&..:;...m .-Q.......F.z6.09..:.s.;.=9..;yr.9'O.9t.<.=9.s..?....=...Ox1.u..N.t.a.w.......A.K.C..A..>Vg..]h...@\1..i....s..P`hV./..[.m..b..t........j[x.b..-.....tQ..k.u...u.0..uZR...l........C...g.FKcX....5'.Y.a.N.l...Z..c..:..a. .L.........A..$[...}..._.2...6..%D.,.J.?.a...zp./........u+7.e...<..3..L2........1[..........5g<..xV.2.8.*33.9eV.......Lwq......0tU.0.w.+C8..2w .e......-.*.f.9.X.-s.2.K....en.......m..I....Km..Scl..m.m.8)$........w...H...Q....{l.6.k{...e_..\.`5R..(.J....3....L...o{*=...:......P.*...R.f..aEia!.mMfc. 9.^.h6.F>.9bT...?..{p/.-....Q......_....^.....|q..g1q.d./.3.&..(l&ok..8../.....s.......|\..........6.)Mzc;...@..o......b....H.~.b.......*k3...c....4.9/T.n&EnY../......U.n.&ULa?.........o.....NlY.%..)W\c]....../-o..i.@..}`.5...z...l......../. .g..l).u..$......O...3.X3.........R..V.n.izj.._.G.0..O..v./}CU..B.v.....&..o.....`..+I.eh+9..EnN]8:...W.k..Xw...5....|.l..

                                                                                                                                                                                      Chrome Cache Entry: 475

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):40692
                                                                                                                                                                                      Entropy (8bit):7.995022526542713
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:slf3K5qlwBM1bCgq/s31UfnLjvNNYhqRhEZGrK5add:6FcWbCgCscGqRh+GrKwd
                                                                                                                                                                                      MD5:97952ED4B06D4891FECE3D3C842062B6
                                                                                                                                                                                      SHA1:CFE809DEF314F3D3569FD24ABA48F00001678684
                                                                                                                                                                                      SHA-256:DBEC46F7F8D5F6A8C9F734ACEF8AC317D05270AA26174E2B875EB44A804C10D5
                                                                                                                                                                                      SHA-512:D40E0038A3F3DE00D59DAD8BC46FB400A2EE167E34EEF577EDD0AFE5A746837D7347EE4D2FA99A25BE60955E2C79FCC7CE9AB05AE0AF1F7D666CFB36EAE3786C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/-p2sH4YIsJQxD5CH4czBewuddWdMPoemb5bMmTIket0iRy1qGcGd0s6Keg9NmjM3cw=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ....0....*..(.>m*.E."..;vL@..6.\...2.{.l...W.,..............e...>'.....g./.O.w........e.T......./...o..x....^............/.K...W...?....q=d.....1.u..........._....1..._.?.xK.........G.....}........3.w...?.y#.....>....S.c...../.{.x......}.._._......................g...|6?%.....W..............B......._.r...........g.......m.........+...G.......o7...Eo..h._.?J..-..%.4..Q*.;Y...Wgg.6.f..4Zu$....t.."..Rnsp.}....~..2.&....tF^2.).?6%..g.....7...D...j.g..G.....h..E..X.+....*'\.....}..&...D1..\.*....\..L.....5o>..u..V.....i{.^.........u...)B...!.hI'@M .]......{..uy..z'..3.{...E.u Y.].....=...[..GP.(.E..=.....32`7...V,.K..;..7.^!$PoXv.......K>....p.(......P?O.:..........r..8B0.0.o.pi..t.H.N.H..TX .9|......';[Wv.V...;....SRV~........m.....W..j.L1...&t.f.8..i.w.'.|.@....-......Xza,....3s.4..ykw..5.&.J.%.......(..qt..d....P.....[.vgX.#.2.....Hk.{...[...W=-.j.A.Y..'.q]..i.....u....sb.0...g.S.2-#..".+l.Ku\.VB.D.qb.E.2...@96.v.4.OQ...

                                                                                                                                                                                      Chrome Cache Entry: 476

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 648x364, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42596
                                                                                                                                                                                      Entropy (8bit):7.994665436618845
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:4ORLOCDiv0fVngq+HtUJFr0uiUBqSE3FaPu5XASgV48fCGFU/yzRkuEfXB:4Oxte0Nng/0r1iU8SokPwAV/KGFU6ux
                                                                                                                                                                                      MD5:09304D8D7AB54176EBB3CA49BF973579
                                                                                                                                                                                      SHA1:EC09BE86A1F5EDC0B8FE16B0A5097E4888489D16
                                                                                                                                                                                      SHA-256:7F670EB338301953E8B4344C3842C5BDE4EEB9221A1C969D74F8A60F052AC324
                                                                                                                                                                                      SHA-512:2288BA387918C4D72641C46D3E57CB03722B317689F10CC5C8A7D18B06A3F2151CA6867E622957ADB6C22FB2D58D320657E17ADB9B8E2CEE284D54E8D2C925B2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF\...WEBPVP8 P...pj...*..l.>U$.E..!..648.D.6..9.N.....n.........|.._.g...i../.....~............S...O..._..x........z..b.[......{.c......W......#..?.=.?..f.....?...........7...Nw..o......O..._.z.~c.{...H..W.../.>...G...>._......l}[.+.W..........{...o...~....t...7.k...._....?.Y...=...\D.(3.XZH...)%..V@.....p........b..Z.9....b{?.a...@.J.T....y.K.W&~....D..{....l...{....R.;.z.wD..6D_1h8.....j...fM....AC......~...k~q...(~.....&...lS..@........}...f..;..m...h..!w..\..j.o3....Xt#{..b6@`6r...B).;...=6|T..pm..q.V.._....k<..<....\...xh.:;...*....y.,b.... :...eX....[..wH6m....6 K....y..|X....S.46.s.._.l.<;.....O......:...:.S.T...b.t....8[6a../..c..$..9..7.>..c:.J...9...-%...@.5d..k.8...AK..h{...8.q`\BZ.$...sJ..$.0.F.!1.b.o...1..h.G...}^..S....t/..;*=..Q.F...4'...di.(1Y.%..f..n...I..!..d..E..<.1X%.+...5...Z.'.2J....J.4..".."..4.;..a.4. :A.......2...u/..dC..Y6.n.l.h....LF.E.b\+..|.k1...<:kD..Be...+........W1.S.,.H..?....K.....ykTwZ..j*u..5...B=.8(..

                                                                                                                                                                                      Chrome Cache Entry: 477

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):6728
                                                                                                                                                                                      Entropy (8bit):7.956249658897854
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:tXfv2Eo7fXfGGnrgG/kZPnpvs/zh6gH8zS:tPebHAGsPpvs/PH3
                                                                                                                                                                                      MD5:4A87B23725F9EC28FA4CBC7EB63637D6
                                                                                                                                                                                      SHA1:7EA800E51FAD2724ACE0C9AAE4DA4E20B3E01154
                                                                                                                                                                                      SHA-256:ED57B68A94FBF6070E9E02C8CF7E77CC4DC7A99238C0F09DA6D787F9DA1A6C1A
                                                                                                                                                                                      SHA-512:D8DFB68630291C04F67F9EDD2C632E0AFE2FCDAF8D4971034B48FB849C714469580823D7857FA2F633F7DBEE3B4C1AB5D54E98A144E19DC4C5F94A3A1BF41A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/app-logo.png
                                                                                                                                                                                      Preview:.PNG........IHDR...x...x.....9d6.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.01/23/18...)....IDATx..]y..G}..g....:....[...16..I,l....N..@q...EH..U!.RI.J.*..J%.......X`.@$,..m..l.@F.n....o.1G..{........}o....~W...#.1.q...u..XX..>.a..)>Q.....-O".{....y.2.>xx......+.?\-.v.i^6...MFz..5..2ogZ...dxn...N.=1`../.4.y...S+.....u.s'x...?..e...D.c5..M........2.......E..x........_u..X........zh.v_y.S.].82S....I.J.....#p...)...Q.......\...a.=...............7.v.5`...m.........p...:..#...7l...3K.?W.....e.p.N.6.....M.b...........>....d....3.....[v....RX.m...M..d0.jl..7..}......F.......].......]......s../m....M.[..01.D..?.j.......!..@....W....8..u..$..w|..w.........(...;.Vl..s.=...rj...o.~.....:...9.A.j...C.n....~*.l.._.=|r.....*.(R./..C.|jz.w.......n......-.-L..8g......t~...|.co.Te4.....X...l..ws.J....v...{....,.J.........B....E...TWi......=.9_I..c]..k...j.. .#M..N.mC........c.Gk..9mn.....T;...^.K.

                                                                                                                                                                                      Chrome Cache Entry: 478

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7860
                                                                                                                                                                                      Entropy (8bit):7.955805602659907
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:LOV54+q/rQD1YSiWl2/05YdNGBhK/saP1FH:LOV5MkD1ZiWl8tzYhYP3H
                                                                                                                                                                                      MD5:46170B933402D7FAFD745DC0CEF0F062
                                                                                                                                                                                      SHA1:239B021E0FE588B2EA6875F584E46F1B09A53E9A
                                                                                                                                                                                      SHA-256:5059ED15F42F09678D74EF63726867324485A18A42A7283A4C0004EA6376CBE8
                                                                                                                                                                                      SHA-512:5E6E9B8B92731A6533365CA6CAD8222F907F02FAC571700BC67145560842D9A9AC4C1EFF10327ED17245220DF14ECDAA0BF1BB4FFCBF0AB0BEF123E7ABEEAE9A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........?..?..VP8Lc.../?...M0h.H.6.?...........v~..<...I..wP=..4.I..m#I...|].1..4.8...T...B...PCw"w.2..HR..c...'3.?.....V..... ...6....0..6..f.7.oX...L..n....s.<..k....|....y...~....G_.......M...N..CA.6....v.......v%K.3..m...1.>..o...h..P"..T=.+.....g@....9{.5.{Q.K....2.......lD.....h..l.o.Q.......].j+.c.s.........A..9.{..'....G.?s..,.A.A!.K....m....!..m;$I..8......bwUW.3s.m.m...m.]Yi.N.K_."..m.m[.Vj.}L-l..}...m.V...?..zl.m...hk.&..UO.m.nlk[.c.dI.P..\fffff....)f....rs....."....di.9z(L...+ ...CC.X.!...JTj......H..&.....x).v....uK...e1v.o.So...4....".........B.B.....-.*.C...........1..0...l..RV.X&.).`.f.l{c\(X.P..VZ..P..@C...x.iy...`.g......-.W*.R8..2..R.....T. 9=t.~.!B.a..LT....N.X.)..Lb...p^}.2.2.."..V%PK..V...9.z..3...... .#h......./p...C0. L.(.0:. ..^H.}...E.p...(@$....!.....z4.@....(`Q.IB[.(...).....Qn%..#....^_.....`.N.I!e2..S.r...hI..W...O.y.....a.5%.......eL.[.]..Q7.P.."."....%.""...);f...8...$.$..b..'9...x.

                                                                                                                                                                                      Chrome Cache Entry: 479

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17514
                                                                                                                                                                                      Entropy (8bit):7.934390195240858
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:WYC8MQOhpYh7rEJH53y02BwaCLVpX4vqvZtB58IvHi:IbQLdrkBeBwppXbZtBxvC
                                                                                                                                                                                      MD5:8EDAA6B2ED06CF3495C8FE9A91380CE2
                                                                                                                                                                                      SHA1:77B0CA25329DA84E78EF02002A30F960DC52F8AC
                                                                                                                                                                                      SHA-256:2AF63F6B0733B0CFB11BD31D2F761C93731D82F614338869BAE39393C2D28106
                                                                                                                                                                                      SHA-512:CBCF94DD8A6D5C04945E2486AF782C5F20EC0190763EF231D0FA3ADF6C0D2396548D2198D64EE763A916D00F32EFCBE1C4A6E5D5FB63F2CE5FB57BC4111F4AB5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFbD..WEBPVP8X...........'..VP8L.D../..I.M@h$..Y}>.?...".?.....LYUZU.o~>....I.T.R....]g..X...*.$.l..<.A........3..Y.....t.....$...$.....n...[w'g(..)U..L..@"D.K^.$.A......t..nw....8e..,$.., G..I.4..[..O....A....nl..5.RtC<7..JT...pF.d0.$.MW3....{R.N.m................!2...t...p....bP...kR$...cP....8D..Q.L;I.....P........e.....(.....}...]f<.H...c...........]....Yih<*....XKw..0lN..d=.G.g..k...p..?....w......e..(. ..'.......o..3....$kP..C.......I.....A.D.+.8..DKR.&.[.`"p.....oQ.H#....E....@.{.#...6.. ...2...XQ+...z.(.bsu|nu.O..A........!6...uH.n...6.$I...Qww... "&...a`@g......=...x.E..w....H.T.....^.|.z...#Z...#~.R..GY>........!.7.PA..q..q..P..v.".......Y..+..z.`.JGf....V3...lm."I.m...Y..%T.dffffj1\@..c.g.n`2_B13333&g....PU.q.0..7=...d[....3.)bz.,..EM.R.....:.8...nl..d.....,.X.G...>..........b.|........ka..i.....F...m..m.*....v..d&...^... 3k....s`..c{..z..v...m.m.#.s..vd..f......S.m.mY..~....g0... ..p...(A........s.1....W.F..s...Z..m6.

                                                                                                                                                                                      Chrome Cache Entry: 480

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):40692
                                                                                                                                                                                      Entropy (8bit):7.995022526542713
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:slf3K5qlwBM1bCgq/s31UfnLjvNNYhqRhEZGrK5add:6FcWbCgCscGqRh+GrKwd
                                                                                                                                                                                      MD5:97952ED4B06D4891FECE3D3C842062B6
                                                                                                                                                                                      SHA1:CFE809DEF314F3D3569FD24ABA48F00001678684
                                                                                                                                                                                      SHA-256:DBEC46F7F8D5F6A8C9F734ACEF8AC317D05270AA26174E2B875EB44A804C10D5
                                                                                                                                                                                      SHA-512:D40E0038A3F3DE00D59DAD8BC46FB400A2EE167E34EEF577EDD0AFE5A746837D7347EE4D2FA99A25BE60955E2C79FCC7CE9AB05AE0AF1F7D666CFB36EAE3786C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ....0....*..(.>m*.E."..;vL@..6.\...2.{.l...W.,..............e...>'.....g./.O.w........e.T......./...o..x....^............/.K...W...?....q=d.....1.u..........._....1..._.?.xK.........G.....}........3.w...?.y#.....>....S.c...../.{.x......}.._._......................g...|6?%.....W..............B......._.r...........g.......m.........+...G.......o7...Eo..h._.?J..-..%.4..Q*.;Y...Wgg.6.f..4Zu$....t.."..Rnsp.}....~..2.&....tF^2.).?6%..g.....7...D...j.g..G.....h..E..X.+....*'\.....}..&...D1..\.*....\..L.....5o>..u..V.....i{.^.........u...)B...!.hI'@M .]......{..uy..z'..3.{...E.u Y.].....=...[..GP.(.E..=.....32`7...V,.K..;..7.^!$PoXv.......K>....p.(......P?O.:..........r..8B0.0.o.pi..t.H.N.H..TX .9|......';[Wv.V...;....SRV~........m.....W..j.L1...&t.f.8..i.w.'.|.@....-......Xza,....3s.4..ykw..5.&.J.%.......(..qt..d....P.....[.vgX.#.2.....Hk.{...[...W=-.j.A.Y..'.q]..i.....u....sb.0...g.S.2-#..".+l.Ku\.VB.D.qb.E.2...@96.v.4.OQ...

                                                                                                                                                                                      Chrome Cache Entry: 481

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (32025)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):84380
                                                                                                                                                                                      Entropy (8bit):5.366845733753481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:/P10iSi65U/dXXeyhzeBuG+HYE0mdkuJO1z6Oy4sh3J1A72BjmN7TwpDKba98HrZ:++414Jiz6fh6lTqya98HrZ
                                                                                                                                                                                      MD5:4A356126B9573EB7BD1E9A7494737410
                                                                                                                                                                                      SHA1:8258D046F17DD3C15A5D3984E1868B7B5D1DB329
                                                                                                                                                                                      SHA-256:22642F202577F0BA2F22CBE56B6CF291A09374487567CD3563E0D2A29F75C0C5
                                                                                                                                                                                      SHA-512:005C3102459DBF145DF6A858629D6A6DE4598FAFE24CD989D86170731B0C3B3C304DA470CF66BFD935F6DB911B723DF0857B5ED561906F7F1C5C4E63ED9430DE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/*! jQuery v2.1.4 | (c) 2005, 2015 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,functi

                                                                                                                                                                                      Chrome Cache Entry: 482

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):5614
                                                                                                                                                                                      Entropy (8bit):7.9560212716780505
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:LPt6bxerPPflk3wflSvLxSj2To9gD7GHhww+Z5Ztjg3pvl9IZCa2B7n1hb:wborPPflow0YK0gWwz5/jalTT1d
                                                                                                                                                                                      MD5:82091A227823F28ECCC199ABF44355DB
                                                                                                                                                                                      SHA1:DB41AB17A4080E6EABA1A0632803812620CC2D1F
                                                                                                                                                                                      SHA-256:A87872FBEC5AC32CAF71F2428341A4F638F9A0DC9AC4310526480A63A0D58DA2
                                                                                                                                                                                      SHA-512:BFD46B17D9358ABB25A4D3B4BFD7F1E8E5CE9D1B30E1740D7E8930BDC618C44FCF98509889DBAF92CA112B5DC7723DBB489442E6DF04CB2BBC54A5842C2860E8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/pQqL4JTm_4PS4UGdvVNnv4f0AYXeRwItrhlAhu84_jtUO-xslQmRaHgrJouYh82OPps=s48-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L....//...M0l.6r..{."...].....j{\..`.I..........;V..H.R-.....8..].m$I.....s....t.?.S..D1..3..v.D/{){.*A.!...9.j...I\g..9..=....ef.%==6.Px..p.m.1.HRq...5.y.l.m..u..i.t..N*..<.2._q.....$I..?"..$*..j.Sk.ym.....v.l[cO?6r..U.......t......$..t'3...5=x.m.......~o.m.m...$+X.U...m..$[9..?.....<9...HJ.....G.....~.]o]x..17.-_....wy.x...#.c.3]i7.....8s.-.......D...t#.. .I2.d{./2.U.2..G.).z...pD......l..Z.pI.....j.v..Q;....T.....2.J.N.(.H..j.>.....:.R......>..*..G..0(....B...@.B-%.a..^butBP.....^....^........=.w.I...u...N4E..".]m.y.......x..4.N......@NA...K......N.G.3.ud".......5..(..j...!...........\.Jg}.]owb.. ..'.F..F.Y....%......&..W....4.....4.C...{v5...V.t=5E(.H...kZ9{..f(h.....3...R.|.....N...iK...4QX.^.3.I.j.FTMGG.I.[6.5......p...G...{....9&....0.'..B.3.x.zD..z.z2......00.:..#...5.+......4.r9cu"S.>.&P.._QZ#...2.XZ.t4.rh.......e.Bo%s~....%r.Q.c.*...Rpki#..8..*k.....k ....r.1......M{...CN.~....'0._. ....Dd.1....

                                                                                                                                                                                      Chrome Cache Entry: 483

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):79826
                                                                                                                                                                                      Entropy (8bit):7.9760101657223546
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:E2XnNcR4R7Gqccjo+bhuUZ5tmQ0aYUWOl7pQAxsALYwYnvUUiUuK16cOq6CWgu:9iGRZPjo+1DZPmQrYeppQSzLYwoUUiUA
                                                                                                                                                                                      MD5:A479E1F625B44C5B7A2DDEBC20B2CB11
                                                                                                                                                                                      SHA1:A43FD972ED37115B2B8C42E78512A25936B43356
                                                                                                                                                                                      SHA-256:5A682C84ECA4B472A7823B3B51072B7994C3FCADC8AFE8882E029676CEF8CEFC
                                                                                                                                                                                      SHA-512:221B113407F0B0497BF06AFF8E6C7EC5C7058AE11913B496A39AA20B399CA3F94891460D91BA73E03F3C5C8988999094520B90C81005A554A1D223E15F20DD11
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.7..WEBPVP8L.7../..?.M@.$7l38....._0..........s..y.:......Z..9g...#By.~....j{..v...s..?..T)].O......}.m.../.9..}M.]U./8....s...A6v..`........:......Q...v7....).@..=3.....#YMwwU.x.<...fV..2.g....t. .{f..!;..2.."....../13...`*........Z...%.f&"2......$...ED.00x...&.:".#:s...f..t.~.|.....zOG..<.>R....j....DJb..IU.'B{...%.2.....^.......J.I.I).!...7[..$!tUg:......:.3+yv.....8..)3+_...3.8G....!I...Z........}..V.T..@=..c..&|.#>..8..B.j.q...1..}..d\.!+..2.V.!>.#h...6......J.....Z..s.z9t../........m.I..S_!.)R....C."Q ....`..<_8...!.l..X."......(.V4..3.....Qv.....L.B.[..Z.~.2.L..Z..a..P..)7..r...6.C`-.RR.)..k=...3`a.$.....R..BH.R....a..W^Y...\X.l.. ;......C.y'.B..^=.!U.....".R}...?.......A...S=.t.9....|w{T#P.I.*.. U*2.*.......CO.C..t6.!......O........Y........c...[.f..:.2..R.@..d..K.\.B].....\ .^..(}.'..~....{.v....'bMn..^.R.=.L!.S.....0.8d..\J....e]..k...x..............E....Ku. ....-X.....*6#~.j..)*Q.....8o8j.......K!&..o.;AE..Qx

                                                                                                                                                                                      Chrome Cache Entry: 484

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):38212
                                                                                                                                                                                      Entropy (8bit):7.993997570128572
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:QB80RJjSBRg8+aPUNJroK5d+rF8hooqnGdAjkyJb01PFj1s:QB8wqGPpPrpo8hooqGcJbWY
                                                                                                                                                                                      MD5:83AC4CAE8240E1782435213A15B04A1C
                                                                                                                                                                                      SHA1:0A3499F2FC4D410A0B945F77380A76078511D4EE
                                                                                                                                                                                      SHA-256:986500DA5D603A6BAA9E89BE92EBB023231B9B2CDB305D567F715FF1A26FD94B
                                                                                                                                                                                      SHA-512:CF22A837F51964B35F07121E92AA8A5540B67B0F880C7A4EBC1F571F01EDAC950E8D59FB0AB02A0396183753372A4C352589776BB1F3848B3889DA9050419A28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/98xpuPXs4xhFWrzmw7BWY_jqUZR82mkmx8elgXxb1jqRQk8Rt9kSivnULSR4QF7LhA=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF<...WEBPVP8 0........*..(.>e(.E."....<.p..fm..+..?.VW....w.~..I./Z..............._..w.......V..........?.O...O...............w._eO.?......L.}.#...s......_k......=...t;.......?....]..k..z....'.............O.~z.......o......P..^.........]....../...........O......;.........../....~.}D.........ot.Y...U...........?...~....}.y....K....'.f..~.|.Q...8...rM..Nz..e...e#JJ...i..Eu.`.v..1.....P-..1>5.|...+...$.<W..F.`.'..T......%.....9...)Ry.c<DlD..3.....~.j.....~.z.l......`.Y......ii.Ot...........v..G....."W.p...........r...jA..........8...G......<..O.#7....G..w.....G.=..".+....r.C..5..+.......E.U0.......6{#+.....M..3^k.w.;|.z.....c.<..z.y.........=......O.;/...".\3 ..A..F9.M.c..(3..#.U..5.....i...].3W,..p.xx....>6.[.....q..:)T.f%x.^....V..^mm .}.V)..l.kb.]...@"...'....D.5....o....B.Y.......uu...A/..9:({.(.c.,..C..,.G!.$~=...m\.k...h.O........*.Y...6Zo".^..Sz;.D..r.....z....3M...&.N&8......#{...u.rs..^......()V.G.........0..C.n..e.....'u

                                                                                                                                                                                      Chrome Cache Entry: 485

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3612
                                                                                                                                                                                      Entropy (8bit):4.777429290813145
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LC4w24wg0AB/Gdxh9CFM5D4qKcxu9fbDoScP3ZtVOR8JfRuFz/J:u4w24wmGaFvcPSG990F9
                                                                                                                                                                                      MD5:5B743F3BCB9E9322A61FD70797B77D90
                                                                                                                                                                                      SHA1:4995F05C859A3DCD31493B260220381D09D8C35D
                                                                                                                                                                                      SHA-256:1B603F9F578A417BEAE0324857AEAB120487F3DA0DBEEC37C0ECDAC4D500CB8E
                                                                                                                                                                                      SHA-512:AFA86FA9E753875C0D28559909E842CE2C86A3C211A1FE67D35E4273C1BA2B1C7A933D82A53142965B792CBAE330238B643217A594ACE13187EBC23D69374A92
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/css/home/auto-activity.css
                                                                                                                                                                                      Preview:@media (max-width: 599px) {. .activity-wrapper{. width: 100% !important;. padding: 0 20px !important;. }. .activity-wrapper .wrapper-box{. padding-top: 30px !important;. padding-bottom: 20px !important;. }. .activity-wrapper .wrapper-box .activity-name{. font-size: 24px !important;. }.}...header{. position: fixed;. top: 0;. left: 0;. right: 0;. height: 50px;. box-sizing: border-box;. padding: 0 32px;. box-shadow: 0 0 6px rgba(0, 0, 0, .2);. border-bottom: none;. background: #fff;. z-index: 10;.}..header .title{. display: inline-block;. vertical-align: top;. line-height: 50px;. font-size: 20px;. font-weight: bold;. color: #42A5F5;.}..header .title a{. color: #42A5F5;.}..header .info{. display: inline-block;. vertical-align: top;. line-height: 50px;. font-size: 16px;. color: #333;. padding-left: 20px;.}..activity-container{. padding-top: 50px;. width: 100%;.

                                                                                                                                                                                      Chrome Cache Entry: 486

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5614
                                                                                                                                                                                      Entropy (8bit):7.9560212716780505
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:LPt6bxerPPflk3wflSvLxSj2To9gD7GHhww+Z5Ztjg3pvl9IZCa2B7n1hb:wborPPflow0YK0gWwz5/jalTT1d
                                                                                                                                                                                      MD5:82091A227823F28ECCC199ABF44355DB
                                                                                                                                                                                      SHA1:DB41AB17A4080E6EABA1A0632803812620CC2D1F
                                                                                                                                                                                      SHA-256:A87872FBEC5AC32CAF71F2428341A4F638F9A0DC9AC4310526480A63A0D58DA2
                                                                                                                                                                                      SHA-512:BFD46B17D9358ABB25A4D3B4BFD7F1E8E5CE9D1B30E1740D7E8930BDC618C44FCF98509889DBAF92CA112B5DC7723DBB489442E6DF04CB2BBC54A5842C2860E8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L....//...M0l.6r..{."...].....j{\..`.I..........;V..H.R-.....8..].m$I.....s....t.?.S..D1..3..v.D/{){.*A.!...9.j...I\g..9..=....ef.%==6.Px..p.m.1.HRq...5.y.l.m..u..i.t..N*..<.2._q.....$I..?"..$*..j.Sk.ym.....v.l[cO?6r..U.......t......$..t'3...5=x.m.......~o.m.m...$+X.U...m..$[9..?.....<9...HJ.....G.....~.]o]x..17.-_....wy.x...#.c.3]i7.....8s.-.......D...t#.. .I2.d{./2.U.2..G.).z...pD......l..Z.pI.....j.v..Q;....T.....2.J.N.(.H..j.>.....:.R......>..*..G..0(....B...@.B-%.a..^butBP.....^....^........=.w.I...u...N4E..".]m.y.......x..4.N......@NA...K......N.G.3.ud".......5..(..j...!...........\.Jg}.]owb.. ..'.F..F.Y....%......&..W....4.....4.C...{v5...V.t=5E(.H...kZ9{..f(h.....3...R.|.....N...iK...4QX.^.3.I.j.FTMGG.I.[6.5......p...G...{....9&....0.'..B.3.x.zD..z.z2......00.:..#...5.+......4.r9cu"S.>.&P.._QZ#...2.XZ.t4.rh.......e.Bo%s~....%r.Q.c.*...Rpki#..8..*k.....k ....r.1......M{...CN.~....'0._. ....Dd.1....

                                                                                                                                                                                      Chrome Cache Entry: 487

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):40532
                                                                                                                                                                                      Entropy (8bit):7.995619656406213
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:k/huNy3xHHS61C7DLFLn2XP384ueY4QKf9roJ+nlwa+z7cz6Q5pmxuP8mh9:kgy3xnz1kpz2XP3yEN9nnSa+vW15oxuv
                                                                                                                                                                                      MD5:581F3D3D49460D70B7727752C3339F13
                                                                                                                                                                                      SHA1:C70220D89F25E1310C2180F280920414A94208B2
                                                                                                                                                                                      SHA-256:B1C9E778A9253BFEC9874245823B23EE8C5BC40D131FAB451F33920EB418E145
                                                                                                                                                                                      SHA-512:020FA8BCE423A980065B7FC72CC61183791FC8A472BFE6B5D077580D787050EBB030F98D6C456DEFE6B1F2CF7B23C76CFA487A1BF3290814EC6BF11C8A7E8C20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFL...WEBPVP8 @...p....*..(.>m*.E."!..X.....fm..#..(..\.r......|..O...~..........?................S...w.O.?R....._.s...|.........w......................K.G.G./.........?..g........i.#...........{......g.K.s..._.}..a.....?/...!.g...o..._..w..|{.Oyo....G._............z..7...../....z..3...?.?......s....._..&...............>B...u...?.O.?..n.......%...........mk~...9.T.......).g../..6{.!.[.."J.o..V.':0.N.{.*......ol.5.........g...y.../ .74..F...8,_.l...i..]hY..!.ky..Y6..9...F.;..e...7!n.?.........i....d...%g{1I^4...,..B.......^..G.l..2._.V...t...5.P.{..........U...K.... F..bG`.h.}l`.......:...p....9..w.V.p..]..........g..}U..I.N.b.w....l@.........j..0........Qq.W.vlG$...Q..... .]..[.+.....D.......0.....h8....#s?.n..F...0...;. L.......2-.x ..../xzY[..J..q.....(..oN.6..p.-....w......).)!i..P..a...F...{ :.XL.S......b=.VD......q.....}......P.|.)76.....:l...Z.+.\./...d.0..L.T......m..U.....v.o..<....KL..{.<..).X./u..f.V&v.]."Um..."s]9.T.....l..L...

                                                                                                                                                                                      Chrome Cache Entry: 488

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1753
                                                                                                                                                                                      Entropy (8bit):7.846356876733626
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:GgEjXa2Ca37qkInSnd6nMqiLiciiMPPMP:2za2D37q7Snd6niLjRM3k
                                                                                                                                                                                      MD5:2C60D6A8E796264F0250A21EEB5C0A97
                                                                                                                                                                                      SHA1:651B1798DD2EE1A8BC3B790F1BB0F57B682AF212
                                                                                                                                                                                      SHA-256:2872AAC827AC1B09363A0F4DECE363E5BA49773B0136D0F62122BD2313372C09
                                                                                                                                                                                      SHA-512:DDFF50C9E1039351DECFF5A9C87D2A12A6CFA4CF323C6AD7B0A058A92191FB876EE611788D73FEF797CA1FD86C857BAD5ADE6FE15223C038CFC5BE50AABB3662
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....bKGD..............IDATx..[ilTU..D.......D.K........(BA...AT4Q.b\....U@..`YZV... !JA)-TJ!`.J.e.2...y.>.y.J..y.y..Y^....}..s.=.......V..iE.a)!.........&B..&..|B.}o....M.....v...B.L@...6.H.vb|T...pO....._2@X.E.GC.....7.@U+..&...D}.+o...#..6...t3..........^.X=.#..S.$..9u-.n.yrH.P..QD..v....4.>.IF....Z1.O.".N^...|'v..w.#o..."..G......g...Nd...11.5Pe.....V.u.7Ep`.-..5.~../.0..4L.... G..bnz..yqH^...knl...*........._.1y..P.%.~..--..yU..2 ...].L..V...v.v....j2...W....``qp<Ab....%..d...;.$..T.p...=.%.(.QFryh..`...hNf.w.O`.g.|Xp....;.w.....&....^]". ..ZL.....u.K......'.x00..x ...B.y....U.."....6X.$cJ.[..nHwb.))..#....w..o.....A...v....w.!1?.%.4..@&.........n..|.2.7.k....8...~.7..NK....%.L..uN..h`.wN.8....hq.z\.v#..zM'../..a.#H.....42c..R..3....# ...K.5#....\....^..ai.r.b...2.#.`..Og.1..WX....%b.4...#....o..w...mx;W.7.....+2^=...)B\._..j.....6k.`2....|.Y&.n....y0r.....9..RY.|y...9^]B..$.....H=...-.....&.i. ....Ons!.o.".....

                                                                                                                                                                                      Chrome Cache Entry: 489

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):21094
                                                                                                                                                                                      Entropy (8bit):7.9920522935726535
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:384:/iFK2kFvXXGJ+vr7UQ3JxqeL607pSqlTGkxUT1UosSKIldhKUvlImyBnL5CUk:6Y/GojwQrZZSqtnsw07MclIm0nlRk
                                                                                                                                                                                      MD5:651BC28C7E597E841D6AF7C6DF10ECC2
                                                                                                                                                                                      SHA1:8F4E7310E65BFFF075F6B722AFC6926CAC7EC879
                                                                                                                                                                                      SHA-256:087606CF594EC3375F3A6E70C517DDD2E7A6A2D98E40FC5A78A1EF96AF8F7AB6
                                                                                                                                                                                      SHA-512:98D25B7968DBAF272C83A8D3432B61D520565D15038AF3B23AD1C669A9F0D9A3775567E0D91C4235D32D01A67846C1FA1698521EC496F3C2D0EFE816F6998353
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/mobile/mobile-slide-3.webp
                                                                                                                                                                                      Preview:RIFF^R..WEBPVP8 RR...B...*.. .>.D.K%.."..z....in....!...@.P..~.?.1......Vw.....y..7..P.`.1..>.?b.@~...z@{........?.7.o`.A.6.......zX.....g................7..._.....=....C.....5.W......C./..o..x7....A.'.k.../.........?....%.........j........d.e.....O...O..?.................W...?....?.?......[...'..._...?C.-................O...........>..k.....&|;....LH.2bEA..*...Pd..&$T.1"....LH.2bEA..*...Pd..&$T.1".....-.....;!...'..&Rm..@.F..v>.*l.....j..a.$I...I.3v^$T.1!.:.....x=..E.e..o.!w.~........uL!.B1.(&.....;.H.s..W_.CM.CH5...x.2.Qm.+.'Z+f..B........'H<ag....Mj!.....L........W.}...m.e.QPd..&$T.1"....LH.2Dq{\...C.1....~$...L.+.F..._..|.)B<..n....f}...w.^/....R..o .qDqC..._....w....`%..v..@..f.....CT.{.-_...j.:.6._..~.\t....4.2o.u.....m.u.E...._.v. F..~.~^.&$T.1"....LH.2bEA..*...Pd..&$T.1".....e~U.....x.MB......N....6-4.v....Y.H.....f.\.36....d.|.. R..o..d..4(..........YL........P..l...A.E|(5..tjc....r....y=....p..C..BV..=6O.......7'.R.W.....tB.A.aG

                                                                                                                                                                                      Chrome Cache Entry: 490

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1398)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):65192
                                                                                                                                                                                      Entropy (8bit):5.62966742878432
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:qwoiR/iuvbWov9tQ/LfiYaKIm0J4FhBb37x8wAj6ObNdCYxnk:qwo4vbWov9L7p4DBb3V8v6OhdCYxk
                                                                                                                                                                                      MD5:6B9BBF6D5961B6C2157B3693950D9A53
                                                                                                                                                                                      SHA1:90CFB3136680815DDF32EF638BDEE5899891ECD2
                                                                                                                                                                                      SHA-256:69B83E36EC7556DDEE62422F0E2F126BF793559DB415E1FB9C75CBA9D751D869
                                                                                                                                                                                      SHA-512:4085F6A64D1E87174FBB2DDF5E0CFFE40ED07E2BE1D4BEA009EDFDBEF40A90268D9E917B946FB44F3F11B029C1EC30E710E3327912DEAE125B279EF5A1D74A44
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{.var fwa;_.Sq=function(a){_.Vj.call(this);this.O=a||window;this.W=_.Qj(this.O,"resize",this.ma,!1,this);this.H=_.si(this.O)};_.Df(_.Sq,_.Vj);_.gwa=function(a){a=a||window;var b=_.Bf(a);return fwa[b]=fwa[b]||new _.Sq(a)};fwa={};_.Sq.prototype.xd=function(){_.Sq.Te.xd.call(this);this.W&&(_.Uj(this.W),this.W=null);this.H=this.O=null};_.Sq.prototype.ma=function(){var a=_.si(this.O);_.ni(a,this.H)||(this.H=a,this.dispatchEvent("resize"))};._.u("n73qwf");.var hwa,lwa,kwa,mwa,iwa,pwa,qwa,nwa,jwa,Tq,owa,Uq,Xq;hwa=function(a,b){const c=a.H;return b?(d,e,f)=>c(d,e,f,b):c};.lwa=function(a){let b=a[_.iia];if(!b){const c=iwa(a),d=c.O;b=d?(e,f)=>d(e,f,c):(e,f)=>{for(;jwa(f)&&f.O!=4;){var g=f.ma;let m=c[g];const n=!m;let q=!1;if(!m){var h=c.CF;if(h){var k=h[g];k&&(q=h.H?.[g],(!_.Aca||q)&&(h=kwa(k))&&(m=c[g]=h))}}m&&m(f,e,g)||(h=f,g=h.W,Tq(h),h.WR?h=void 0:(k=h.H.H-g,h.H.H=g,h=_.Yha(h.H,k)),g=e,h&&(_.F

                                                                                                                                                                                      Chrome Cache Entry: 491

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1506
                                                                                                                                                                                      Entropy (8bit):7.8355043994591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:bjOqTuObOflLYlKplL/7HjsNXbhE7rYu4IcVIeVzKRL3HhhUpXHpWRbtbNXppFp9:baMuMOflLYKlDsNLG7v4IcV7VGUURJBN
                                                                                                                                                                                      MD5:69920EACA11B70A58900CCC60637F21C
                                                                                                                                                                                      SHA1:6EF345F735C2CDDC9306135B6AC05D25AEC74BD1
                                                                                                                                                                                      SHA-256:D3502D89B76024AB3F37909BEDE1C5E2EDC05F9A2E7BF03BC7BAEEC45ECFE0C6
                                                                                                                                                                                      SHA-512:7F4AF4EA28139FEC3CE2061281756D2CDE63DE9062C08C063F2FE922744302C47CF1DE032A8935602BED913EE79654D0A1AD3B22B53A6EFC31ECDBF477052276
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../?...&:......m...*.m..m.m......9Y..t..U&.@l.).-w......Sf...:.@f.3.....*....Ef...p..6..sg.9.....l..#.c..g[....;. #]J.B.k.f...m[.m..![....l.Ij..l.m.m....}3?....a..u/C.....e`..vtt..@..0.....I....`...c..(....&..7.....P...)p....i.....i........-..Y-P...asW.......2.f.q...{.W../;.m....<...VD.k.f..+.VJ.....nF.@.P&...A)PR](..vj.......$H8...._.3c..y......_S4o)/(..-...-p.....{h..M`.%Z..!46u...=.4...'-Ru.M>.0.HdKg.|.=...>;B+:y.@.*..S...D..?./1...m..".................2...i.'....U.....0....XD.T..M.:3......d..%.^^....V..m....w.f...^.....P...F."jo.....Zw=..(.ey.......]...W...c...`.M..n...u.h.dv.."..u..~..C.I*..Y.=8..........I.zn.......uiL.I.6r....rJ.d.>.....Tr....?;...z..*2..-.y.z.....7.8.WJy...7......J.R......f?.T.82..[.y.../..[...7..=.......(.S..$.$L...G..........L....@.M..?...!dA..F..*..u..Ca....-~n.{LB..I..d...t.....u...v.f.df ...f...hL.......@=4{..;..k.....9b.;t ...W...........Z.e.c3..I.1.E.....=...gd./..Q*V..Nd.).oF..7~q.

                                                                                                                                                                                      Chrome Cache Entry: 492

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12552
                                                                                                                                                                                      Entropy (8bit):7.972140027143501
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:A83GXWY1cES3sWUW5jNwnji1+S3DxD7oaqEOpSPVgsZgQlMfsDbSgNK4DWO7s2df:A8RY1y0GNRPRoacIW3mMfs3i46OYU
                                                                                                                                                                                      MD5:F3AF256639B57B164A955E3338170D0B
                                                                                                                                                                                      SHA1:A9E729530633AF5FD692753B41B4C82EA9C1BB46
                                                                                                                                                                                      SHA-256:951046F75A25CFCD6980FEE16DA526151E483A33A9C284EDC70013C9068C2FE1
                                                                                                                                                                                      SHA-512:20C6FC7507EA824C45110F439BEB72CBE9312304E4CE32DD1BBA89427997E42C73BBAC7BF9E6EA35486949D436CAF37E16C15170337A57F0E71B990FF2ACEA0C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.1..WEBPVP8X..............VP8L.0../..;......|p..... p.@D.'........../.sy.f|#).....*z......./..]N..|.(:...U.*7.d.k.... ...J..........$m..$5...{.$&3....H.j..u...........p....M#I....p....E...m.V... ......H..?...B.2F(..x._.^.p`.1....".p.....c.1.0......#g.....AM. ...k...L.?S. .......O}O.g..i$./...H.....g.........&Y&......1...Db.5kP4i.z.w.s..(..... <.#.!...m..,.}.D..w.q...;.."..s.&...$..9....H%....9.....+..t...8..s..Y}..a..F....H.V.t..../..FJ.^M...E....A.. ...g.|kk{.I...l..3...6@..;..>S)<..}.D.......%...P.R.@..........U....&.........r..yl...$HLl.&.`..U...m[U....G.BkV..A.....$..n...X.....5..$EuL..E.B..+............k.H.........}t.9...k................$.....m7..hc. .....#.A".C;cf...x.4k..wN..;$..4'juM..%l..H..U.IU.6.l.m.3.Y.9ge..m.m.....?.c.j[.c....X.^n*.N.P....D....03..x.X.H.8.Q.+.N:..N.7.v.._$...~......eff. n..'...Y..w....`.gvfj.J.'..jC.......bv.%.a]A..`c..S..\.z"..M..E."a.cI...& ...N...m[.F....%3...Sf.....f=.5.0.0+f.2..mY..tl.V$9.....

                                                                                                                                                                                      Chrome Cache Entry: 493

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37652
                                                                                                                                                                                      Entropy (8bit):7.974148108955924
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:Qq8Z5qjiJHYdijkie+xJFCCQA2oHW7UtUI3/JWFp43tPt4V+L3+H:KCiwie+nFHquqI3hgpkCML3+H
                                                                                                                                                                                      MD5:D6BFE3DF13973B305DA1D021B1E5988F
                                                                                                                                                                                      SHA1:A73D7391BC11B81C4526211A554DDAB04376CDB3
                                                                                                                                                                                      SHA-256:2E9CB798FEB5AFEC38D5C84B02FD246883761C8F7961E26F361EE31C2C425C99
                                                                                                                                                                                      SHA-512:D03F9DBE4A45CE437B31A252CE7CA48727993A6A8D46E03A8FB1C286AC0D67D871AC888BDC17D9D9833E417BF07710710DA1E7DAFE3EB84AA8AB312D49939DCE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF......................................................................................................................................................h....".........................................T........................!.1..."AQa.2q.#R......Bb...3r.....$S....Ts....4CDd..%c....................................7........................!1.AQaq......"...2.#.R..3BC..............?...Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P..Q@.QE.QE..E.P...8.......8.........N$z.4S...._...-.......i.R8..4.N.._.~..Z...._....Xu.X..h.o./.i.Z..'._...-8..8..5QN.......k-...~....qc.$z.TR.a>c..+h.s.......tS..w...y`.....~..Ww........`g'.v...T.H.^Lg.........v....r0.#.....).]E...$.$.O~].m..... .W..3.j.5T..EYE].?&k.8.Y.3.......f.+...I#...8...Z./.....$G.].........8...[...JP>G.O.k....s.R._....##<.EzG..c^).......:.~G.O8..........

                                                                                                                                                                                      Chrome Cache Entry: 494

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (946)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):209867
                                                                                                                                                                                      Entropy (8bit):5.692065142670643
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:tGmOZSa32f6NEr75WZdzEwPUjV9TFEYWe7gH/BVdPGsRMOFWyBZEN:4mOZ1+wPUZF2agH/BDFW0EN
                                                                                                                                                                                      MD5:0B0BCAE45B57C8F594E5EE800E04816E
                                                                                                                                                                                      SHA1:58E0BE3E9E6328CB7A1BAAED89A118175B928BE1
                                                                                                                                                                                      SHA-256:9B3C512A30B86AC59B8957301CD61D618B96E7CBDF9CEE7DDD2B53334C94A2C1
                                                                                                                                                                                      SHA-512:8D415D16BE4696DDE85B33C0DD79A1257C173D7018EA99711EF7A24A951E7663411D49A68DD3C952CA6A77B67D8CE82F00B388B56FC9FC9E906AB24FDEA82668
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.vX=function(a){return"Rated "+a+" stars out of five stars"};.var cNb,eNb;_.wX=function(a,b){b!=null&&b.O()>0&&(a.open("div","mzPddd"),a.ha(cNb||(cNb=["class","pf5lIe"])),a.V(),a.T("wb5Mjc"),_.dNb(a,b.O(),"L0jl5e bUWb7c","vQHuPe bUWb7c",b.H()),a.U(),a.close())};._.dNb=function(a,b,c,d,e){var f=Math.floor(b);a.open("div","D5jpjf");a.ha(eNb||(eNb=["role","img"]));a.ka("aria-label",_.vX(e??""+b));a.V();e=b-f;f=Math.max(0,Math.ceil(f));for(let g=0;g<f;g++)a.open("div","CPcfF"),a.ka("class",d),a.V(),a.close();e>0&&(a.open("div","j3pqac"),a.ka("class",c+" cm4lTe"),a.V(),a.wa("div","UZExhf"),a.ka("class",d+" D3FNOd"),a.ka("style","width: "+_.Zo(e*100)+"%"),a.V(),a.close(),a.close());b=Math.max(0,Math.ceil(5-Math.ceil(b)));for(d=0;d<b;d++)a.open("div","pai7xd"),.a.ka("class",c),a.V(),a.close();a.Ea()};._.fNb=function(a,b){if(b!=null&&b.H()>0){const c=_.TS(new _.SS("{COUNT,plural,=1{1 rating}o

                                                                                                                                                                                      Chrome Cache Entry: 495

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):39328
                                                                                                                                                                                      Entropy (8bit):7.994553634657984
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:A/WR0bD0TlgaAMvBzBy8EWlua4yrg0yPlnGMMZmXVTI8Wgc1W6:us0bohfzOWlu25qliZmFpzuR
                                                                                                                                                                                      MD5:D99582F67A3ECE0D09B9D9D540FE885A
                                                                                                                                                                                      SHA1:87DD927AD44F8A9EB59BBC13DBE8F89F5E7A2AEC
                                                                                                                                                                                      SHA-256:ABABC2F9BC320FF88E90359EBE4FADDBC51A98C35E2C5783CCF0D5872F3E0C88
                                                                                                                                                                                      SHA-512:0BE4FDC1E427AA9072290A21C19B8D0C0619DC80999FDF9C5DB5AF6B67235D38B87F8CBE817877C6AFCF7FA0774A76451D2D5F7AF7FA1A96344742FE60EEA871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ....0....*..(.>i(.E."!.[..@...6........F3=Y.t..~....O ...O....k..v.../...}......+....p.._...r=.~.z......{.....g.G.w.........{3~.....zu..|5.t.....u...........x.......S............3}....W.....'...#.....|..M..._......o}....N..W.w..j...O........./.....v.`?.?..............u.........?..o~..........._........y......l.....~....w.y......F...7^.e[..@Mhl....o...Kx.ez....D.^...Kx.'y~...=s(nr.<..{.3g.)..3.e.j.u..?h".P5J%G....v:...)`..xD.#!.H..cv.Z.Q....Y9.mF....h.-....rSX..j3...-m^..n....[......R.z.........u~....nB....!(I.S.V.x.:..=:.(..h...`.\...jE79..-$.~R.a..]m.....k./..M.....[z..4(...cvu.. .CEU.$..w*.f...f.Y.l'r.r/S.Yh..G-,.Ew~.u.*.C...]ynF.?...8.l+X2}^{p...G..2.R...........:xrHW.zU...@{.b..w...?].........-..'.....?.W.S.t..z.e....h..L.0.^....uq.Q.p z...8r.I...v3......9..K"hC?.../q....~....!Q.../..q..............5.Z....V$=...u...J`[8..;h.....l.;..W.b.{.W).W1..E.D....../...1i..}....C.).9....[y.`.....Dno..D..qC9.....E...p.*d......Z*!.p(T.

                                                                                                                                                                                      Chrome Cache Entry: 496

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):835
                                                                                                                                                                                      Entropy (8bit):5.1223932389292655
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:D76bBSDFvVdGUF+fWlp9CkXXW/clctloFHMZeKsf:H8uNAwlpJmicnosk5
                                                                                                                                                                                      MD5:A88ECA42083170AF225E964720471609
                                                                                                                                                                                      SHA1:B73B59A702C62AD43B7617FDD627693C5240C659
                                                                                                                                                                                      SHA-256:88995CCAA41E5467D559C0BE6C5D61FC5A49DE7E194861AC9EED559A5B4FB6F7
                                                                                                                                                                                      SHA-512:21217F9BB3CA7F8D735448BFC4C3E3AA277B13B4BC1127AD5F406E84E00847F902533C45F145D1C050075EAF8FB249121C96A27CD9BF2BD18BE08286CF57D6AB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://ssl.gstatic.com/support/realtime/operatorParams
                                                                                                                                                                                      Preview:{. "operatorDeferredUrl": "https://ssl.gstatic.com/support/realtime/operator/1726819261182/operatordeferred_bin_base.js",. "eagerLoadHostnamePattern": "((https://www\\.google\\.com/express)|(https://www\\.yt-web-green\\.corp\\.youtube\\.com)|(https://www\\.web-green-qa\\.youtube\\.com)|(((ads|adwords)(-.*)?|campaignmanager|photos-.*|play-.*|support|support-content-staging.sandbox|business|fi|.+\\.corp)\\.google\\.))",. "eagerLoadHostnameFlags": "i",. "cbfVersion": 1726819261182,. "screenShareVersion": 1727168469248,. "settings": {. "enable_customer_can_end_chat": true,. "enable_emojis": true,. "mole_show_survey_url_percentage": 100,. "mole_skin_version": 2,. "operatordeferred_report_rpc_events_percentage": 10,. "screenshare_skin_version": 3,. "rms_screen_share_skin_version": 4. }.}.

                                                                                                                                                                                      Chrome Cache Entry: 497

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):792
                                                                                                                                                                                      Entropy (8bit):5.22005073702102
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:kzeTy1wRTDN1BR91PRN1jRJPAeC1LRL9rl:keTRRTDtR91JnRJ4eGRL9rl
                                                                                                                                                                                      MD5:EE42271B60C4764E551484A2E4D47BCB
                                                                                                                                                                                      SHA1:2BBDE92E44A7EB58747F2E53D9F7F71983593F89
                                                                                                                                                                                      SHA-256:A289D1011B279F779BB42B31CADCE830EB17C1FFF4B895552A5CEE589E3359DC
                                                                                                                                                                                      SHA-512:F21EB59C68E77C0DE68C309C0FD1076B54C46AB39DE4EFD12FFC588FA173019C9871BE8008DD621E5BDBA03DA721DB49A780D5E76433247666EFD888779F976D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("yNB6me");._.pr(_.MCa,class extends _.qr{constructor(a){super(a.ua)}H(){return"yNB6me"}O(){return!0}Ya(){return _.Ybc}});_.Zq.yNB6me=_.ccc;._.w();._.u("qqarmf");._.pr(_.xDa,class extends _.qr{constructor(a){super(a.ua)}H(){return"qqarmf"}O(){return!0}Ya(){return _.Adc}});_.Zq.qqarmf=_.Efc;._.w();._.u("FuzVxc");._.pr(_.zDa,class extends _.qr{constructor(a){super(a.ua)}H(){return"FuzVxc"}O(){return!0}Ya(){return _.$fc}});_.Zq.FuzVxc=_.cgc;._.w();._.u("I8lFqf");._.pr(_.CDa,class extends _.qr{constructor(a){super(a.ua)}H(){return"I8lFqf"}O(){return!0}Ya(){return _.fgc}});_.Zq.I8lFqf=_.hgc;._.w();.}catch(e){_._DumpException(e)}.}).call(this,this.default_PlayStoreUi);.// Google Inc..

                                                                                                                                                                                      Chrome Cache Entry: 498

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2454
                                                                                                                                                                                      Entropy (8bit):7.656647028291637
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:D1ZaB1Kuq2uqM1pCRK/risvPtk0iKdrOItz4rhAp0IH3gS4GAAZqe7QONmOLm:3I1vq6MrPr1v+krOYWhAp0IXXRAze7Bm
                                                                                                                                                                                      MD5:9CC4BEFA5AAEA2BD8B762553C4ADB462
                                                                                                                                                                                      SHA1:54749D2135966E01F9882A9C58E72C3EE92951B5
                                                                                                                                                                                      SHA-256:970A6A20C4FA6923E48EE64EACAE820369729FC96787B83CCB81BFD892C32DD4
                                                                                                                                                                                      SHA-512:AA4462B404F0276BFADA7861805E112535C3B4F29DA3E6A7B0BD3F37C3B5303DA7A0F1EF81502D5B3DC0D3E2A932692F763BDBB73B7F9D4D347EF683EC7A3B11
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/android.png
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD.............KIDATx...{l.g....t.;.8c..b2.^.?...PzgCP'....f.m.].......#3s..N.1.1t.....h)....o]......{K.....yO..C.9.<.9.y...s+o.....yO.u.P(...B.P(...B.P(...B.P.\......,.,...[JJ..KJ*.:#U............V.......C2#....{.....g..e_.F...W...\.2.......O..@.9 1...Z]...<.v<F._.=UV}..m.M.>....y.....z.....9.....J.....t...C..b4.....v..o..#G.7...5..N? ..........U.+..}O...^...P.........X3y.Q.e;.......'.<.%..7..{ z.z.@...).P.:.;....<.^...l....pbN.f.e.d=.....t..e.hi....T....R J...!%.........H...P. .l..@..2............H. .....H+ .!..-...@..m.* . .P..m...............2......\H.d+ . ...@-..8...i..Q1...i.T...pH.....i.d.tH...PrH...T..$......y..........H; .!..m.t@........v.@d.$.......Z..Rm.@. M...>$?.......&@.B. .......t.r.......2......\H.d+ . ...@.q7s\.... -.<.q.$.........@.C. ;.......jJ...H...P.# ..v@: .....i..@R@fB...............y..H.F......Cz..D.T..$`.q..~..qZ..H. .).s*-H/wwP..$...mA..Ho..NOg<.^..K.hw ...ho.<f:...t....Rpt.D..

                                                                                                                                                                                      Chrome Cache Entry: 499

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):7266
                                                                                                                                                                                      Entropy (8bit):7.965279625699612
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:SGUrmQeyPxHBDDDstMt0kPf7bj+vrGK9qie0KpYoI:5U/eyTvsKtFPf7YKK9q70yY/
                                                                                                                                                                                      MD5:BDA17878678BCE9E4E085DB67EEE85BB
                                                                                                                                                                                      SHA1:4A3A2F85987BD5D48C4B1C2F36EE55810C5B31F4
                                                                                                                                                                                      SHA-256:7017FEF114766D00175764DF69A29D357E23AE4FE5E1A3C04944F7102BD85F70
                                                                                                                                                                                      SHA-512:2C9D5E23F012E01FAF42A03D8241F45620C28D5BCDE48A7BD8C9D3D0C23A48D1D6A7135CB8E61713ADA800278D2DFC48FC9AD4D941A32845390D5CB976CE2239
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/ZRzwY5VGjWUljK-8wcANoWf1AnnYvNZApQNeGw0fTs1IxMr8eENxuiJ8z-_mzzsAAg=s64-rw
                                                                                                                                                                                      Preview:RIFFZ...WEBPVP8LM.../?...M0h.H.....g|:.....R.#..=..A...6Y.L.m....$)*.J...W..7..Y...\8.........I........bf.....L........$.>..7...H..Y.........*V}...Il..[7;....IZ..G....r*..\.qg5...,.f.6.i....@.6....5D.. d..&...kd9.V..,3......:f;..`.....w.......5|...S].U.7...J...v.....A.......d.).....Y.f.:U.j.vmU}.sn$J.a .@....j.........#I.l+.u...52.D......M..X...$..~..A.4+]..22.h.l...m...l.vf!;..:..s...wlV...AF....Q.m.fv..m..f....vcs.1K...........Z.q9....m._.?m.....1.g.$.4I..l?./..I.m..#"...m..m..eo{.m.>....8.X1..v6.OJ)..P......U.K&.L..."...N.-_.... ;..Gw.:j....!.P.V...Q;.P..Q"...N.v.2.,....y.......\....?..3..@.C.t.........I...(...h.`j..(...%.t.o.R.r=..,k.J..........m..5L5..R(R..M.....P..Xvx.A.&..v...csJ..".m.3.u.{...M4.{.Wb%."ryP..._...;....R..$.l..."Q@:WU>=).v...<.........$&3..T.3[...\....8.$". ..v...3.mi...L.j.9...O.,..AvzD..........E,.8.M...i.....\.qF.e..".'........P...A.X....0.v...p@...AzLu.TD.X...`.....C.WB....tQ.q.5.bTS=.S..ZUB...-..]...

                                                                                                                                                                                      Chrome Cache Entry: 500

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2711
                                                                                                                                                                                      Entropy (8bit):7.852022310856631
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:lVSwDSYzzOJtg2oZVp8OkhVES6bo9G5yZQwffYj7JQXDeKDa3kFoEP8/Z6f1ZlEr:lVSwDSizOJtgBpXS0sZhXmJQXDDa0WEc
                                                                                                                                                                                      MD5:B6D07579739BD1129E692D6A7F393756
                                                                                                                                                                                      SHA1:A51465B52F2B77BA7BD073107541877668F7D9E9
                                                                                                                                                                                      SHA-256:45E16FE9A2E7266228404F5093C1A6D87FC1B7EDF6993A242DE7EEDFDA28D8CD
                                                                                                                                                                                      SHA-512:9D3F6AD7EBB9BF88FF638ED66014CD8706104FD298FB3BC9070184973149B300F70F073F356D591EB26596FD28EFFB31B9E68D712918C9D3DCF6DE09DE48E682
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W......^IDAThC.Z..\e.>.?.{..,...[...by4...@..F.$...J!J.....E@TX..>".|!. .. J.Q..`Zk...T^....m...;wwf...d:...-&.d...{.....s..!......I.&&&...4...'i...0.+.......Z... .)......2.."r...Xk...c....DdK.Z.d.y.P(..P./.y. ........1.I~.....HZDR....5..H...1. ..Z.`A..{..3..|.\.2.|LD. .N....;;.W7J.>..$o&..B.0.+.....p../......O..G^!y..;...x/ .]p?.ONN....O....a..X.St(...e..........Rb.[.n.\..x.....-........u...3]_...J..S....s..;X.a]..Y&3..4'J._..{5..w...$.J.."r.&m.....OE..R..r.U.QZm..KCiG.Z=.../...y.d.R..O.".t........N...U....L&3\..."y..,..|..5...>44.u.$..............D...~..k.4..7Sa..J..$.......[..$......8.q._..j.q.|.In.f..3..s.....D.......ME.q...k.&..=...m.$...........a. $......y.....#$o..ZDr......8=....m..g...l.O..j..."..hk.....>...%...s... ..CE.>.....n.y.g...gZ;.(..K.n.+...Jrs..g...j...(.J...>?.p&I.{Z......R....y.5....WD.<.}m..'. .K..b. ...Q...(".G].~...$w...Z..A.FEd..gf.Q.Gi.Z.uoI.R$.....$m......7...1..w.`)....|.B..l....8......D.>..

                                                                                                                                                                                      Chrome Cache Entry: 501

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1442
                                                                                                                                                                                      Entropy (8bit):7.801015614718948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:FB4TtLsXlTbVp50Ud0l0jGGtuF3BPuwawrCUw6dUUWr7y30vEhIYd0WQ:P4psXlTpp50dl0SGtuF3BPuwawrCUw6O
                                                                                                                                                                                      MD5:E56D18D183F48A7F0590937CC428B161
                                                                                                                                                                                      SHA1:D60374CFB103D44B0169C92DEB15C5F11B471866
                                                                                                                                                                                      SHA-256:4E78D3F6468261893EBD1D9E81095489CCDC3C2594DA59DA5AEDC7D9F725C171
                                                                                                                                                                                      SHA-512:93891B30156FEEC042E983C2FF8204CB457DA13ED5702C8FE1DE7AB6F4DE6FAB17E5B656D748F7A363F84B3C540A90EEA417A9DD2EF7BE03B8A4DEBEC6BAC328
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........?..?..VP8 R...P....*@.@.>y(.F..!.3.=P...l...r.q89....r.V{i.f}^?.~.{....6...q.Dj..q.i.Z..p...C.E.?.......h...w...1....#.b.>_...G.u.m...]..C.......V.Q./..W$... ..+.U...8Q..{...P)......:6......)9..i)..;....5.........B.....3..WF.j...*jhb_Gg... ......=....d......T.5z-.'...h..x.~..I..-..[.....7.0>.ymA.....|.T.d.......G....|c..*9....(.....|..89N...L....El!J...3.._....3R..5fyx..b....kJ.BK.D...\C'T.....0.(.6.\..w...^OC.=...&...(.e.....PQ#cS..I.l......4.....rs.L`...C}.i...r.7.*.F...v..j..............>,....T<..\.....d...{.:R.L..~..6.x.2.....Dl..Nc?.>g.cc.Z8^.I.+......./.$.`.....4..a|.P"...;.{d..f...s|E.a.......y...%..P..j..|............e,....^._..p.3D..tn..`...\.L.,.'..0C.k.>.U.......VD.7.&....we.D......<.....\...c...8.M@y..&.>.4.^...?.s..x....p'6..uE.X.D.R.^d[.x.8w...J......1.J.W.~..i.#l.......5#...T].=..:.8........f..=.v)..E0#..........j.'f.}...n..wz.?.....93...|..,...2..H#......\N{...v.T.-..S".........y<..JTIpl.i....&.

                                                                                                                                                                                      Chrome Cache Entry: 502

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):16242
                                                                                                                                                                                      Entropy (8bit):7.9402572379727125
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:Xuw19G/c5AIyS87w1YRmRAjkECvcFd/NP5zOoYJw0:P19GU5T587wiAsw0H/NPeJw0
                                                                                                                                                                                      MD5:6B2CB8AD472A93B0D97FEE592C13E1AB
                                                                                                                                                                                      SHA1:F40C495C1CA874FE508F6F69059041A5243D9A38
                                                                                                                                                                                      SHA-256:49CA14F45BE05F2A2CB10304CB6481A9A18E15141819C86D15E8891CF371AEC8
                                                                                                                                                                                      SHA-512:7C63115A9EA99072CC01CE04D354952C4EEC03B7CB781186199F6D45967A7FD5D7E190B2810D671F53A03A6B3964AB1B7F7A4D84114EF3BCDA7BA4BCABA23C1C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/dSg_iqQpKYA/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF....................................'.....'10-'--5=PB58K9--EaEKSV[\[2AemdXlPY[W......./../W?7=WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................H........................!1.A."Qaq..2RS....#B......3Cbr...c...$...4ds.........................................................!1.Q.A"2.3Baq.#.....$............?...B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..N..N+.P.?...8.n....Z.>H.9.N..N+.P.?...8.yC...L5a.G...t.bq^...}..{..g.a...>.n.......<....N+.....K.|..sp...W.G..LO...n....i/B.a..a:/...n.....C1>.......a..a:A.N$..yC...Lp....(y..V?.>.f.......<...../.P.?..X......O......3.1.b.>...i/B.#..!:?.x.yG...L>..}.>g.c.^.....Bt..O.....;.6+.P.?....?.>.f.......<....6+.P.?..Xo.g1.....{..g.a....(y..7..........3.0.....<...V....Bt..a.^....a.^..3.0...s0.Jz..c...?.%?.w....;..4

                                                                                                                                                                                      Chrome Cache Entry: 503

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2658
                                                                                                                                                                                      Entropy (8bit):7.894790694325241
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Xp4zSbrw5GYTT7TkhBtzfdxUQr9Yssm14efaCuIUeB9fGhDurKp3CF7p/+RZsux6:rbrw5JXs7tzfnUQym14dCtWhDI23OzA6
                                                                                                                                                                                      MD5:D547E08C578CF8D677CEFDEFC9FFC816
                                                                                                                                                                                      SHA1:0E000BDD5DBCC2593B480F69FCF2D82AF1B3BE9B
                                                                                                                                                                                      SHA-256:D155ECD552AEB2C7BCAA90227BC894992518946248DFBB57FEE4804BBF2A8C13
                                                                                                                                                                                      SHA-512:65F99E17EE3872C85BA5B80492B4805BA060FD4B54DF6071D2255E4DDCF9C894F474475DC3369A53C31A0A28B5F576305DD82A64CE811622CEC06E9F40D22FB7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFZ...WEBPVP8X..............ALPH.......m..w.....m{...].m_3.m..kt]=....m.J.A.d.RW.r....`},..e. ......)Y.%.H..i.."..%.K.r.>7:..K.?~.V.t..r.K.ei.{.M...'......./.HW...].U.>.K,.....J..q.5......JI.....[..A.`.....5.9g...R...Z2.... ..hW.)i.t.$m.B,.F.Y<..Ri.NS..X8......]s...........?......Wlm,....5...`~{.....-....;i\q..s.....j.,..}.4)1Z....P....6...>.....H..s..2...C/..-7...{^{.Y..@...+>y.s..D................s...Z....d..d.~{........g]t..H3(Jk...F.jO.K5...O...UT......-U...G..E.m.S%.u.}./*g>....5.&.X.j.f.H..g.:3..7<k.iMq.4B......NQ....U...)... ...-..jr....VSi6F.K....A.hCS.hLp...V.jL...!...B.t..4..0.4M.(....+T.R..d._.9.hQ...F..VPT&.b8.....g?b'T&...v[....................$;*.tl.i..;..(...ES{....D.Et......J.,.{.(...HI..y.K....no.{o.y.j.HvQ...P.........~...*....k}.._...."....eJo..W......;M...}..JgD*..M..+..jj^..|.....UIgC..=L..^.o.9...O.%.~...| ..$?.U....)....s...5'..GO....ff..p...W.=...y1......*..W........`..............+iDHe^..R4.o......-....DH.@

                                                                                                                                                                                      Chrome Cache Entry: 504

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3510
                                                                                                                                                                                      Entropy (8bit):4.770486597891659
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:+Y+42e/FkkR72e/Fkk+K2e/FkkR2hJ2e/FkkbA2e/Fkke:xtqk5tqkPtqkR27tqk0tqke
                                                                                                                                                                                      MD5:6795128E5015F4412BF87C8909466668
                                                                                                                                                                                      SHA1:C195835ED321A899A05ECB2941A1EE9B600834AD
                                                                                                                                                                                      SHA-256:8C44954F53BEA7A3F7C31D25AB0881E1A1787421FC3B6EF7D0164344AEC38BF4
                                                                                                                                                                                      SHA-512:FC6110EB88F842E6CEE83818B2D02EB0944CEF292471937A42EEE1C1DEBBDACAC4837D8B3E7EDD44B252EF0A55C1A9E04DD282255DA7FD3DDAF704F9134ACB71
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/stars.svg
                                                                                                                                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="127" height="30.003" viewBox="0 0 127 30.003">. <defs>. <clipPath id="clip-path">. <rect width="127" height="30.003" fill="none"/>. </clipPath>. </defs>. <g id="stars" clip-path="url(#clip-path)">. <g id="Icon62" transform="translate(-802.284 -421.325)">. <path id="Icon" d="M810.667,435.627,806.212,438a.572.572,0,0,1-.778-.245.593.593,0,0,1-.058-.371l.851-5.03a.589.589,0,0,0-.166-.517l-3.6-3.562a.59.59,0,0,1-.01-.826.574.574,0,0,1,.33-.17l4.98-.734a.577.577,0,0,0,.434-.32l2.227-4.576a.572.572,0,0,1,.771-.265.581.581,0,0,1,.262.265l2.227,4.576a.577.577,0,0,0,.434.32l4.98.734a.587.587,0,0,1,.319,1l-3.6,3.562a.589.589,0,0,0-.166.517l.851,5.03a.584.584,0,0,1-.47.674.569.569,0,0,1-.365-.059l-4.455-2.375A.57.57,0,0,0,810.667,435.627Z" transform="translate(0 6.259)" fill="#ffbf29"/>. </g>. <g id="Icon62-2" data-name="Icon62" transform="translate(-776.284 -421.325)">. <pat

                                                                                                                                                                                      Chrome Cache Entry: 505

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):42322
                                                                                                                                                                                      Entropy (8bit):7.99596563855182
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:eVTTtywwXjTdLjwT35hjsan6BzmcfM6DDyLRB3Qu8zgy1vXUGFcndCKLev4:eVHvwtLUhQa6Bz/MSDeRBQuigydpuB44
                                                                                                                                                                                      MD5:28072429C2565CD8226F3FE62774AA3A
                                                                                                                                                                                      SHA1:AC550713A85133748B331306EF7FF084826B4CBD
                                                                                                                                                                                      SHA-256:410CF2E9600AE8EC37701944F7ECCD2EA54E82D91FF19559F4E8823C1E344958
                                                                                                                                                                                      SHA-512:39B59CF822578E57AAA6F3888B425D385BDA24D8511A4CE89CA26274B497619880A1C2C8DBE6C21F2C531AC15A2A2B5D82C2938ED98BCDBEAEC1D07006A5DBFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/Z0LK34_wWpk7MljfTZZVsetEOlsWmFetyg1cptZuk0PeGr-kp9VoD_O5AHZOTJBqoq5f=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFJ...WEBPVP8 >........*..(.>m*.E."..07.@..fm-*.q.[....?.b.......HnM...ZM.w........y....c..._.oa..?..S.......c............~.?.......Q.9.#....g..^.......?w=..........{....(._...o.|......._/.....g..........?..S...... .S...c.......^....S....../._..~..........=\.5.W...........~.>....k.O....._........W..........n...O..._._.......e.....'...../........#)'.u{u...4$.e0d...I4..);^...R..i.@..4...(...GH......N...k...=..w.]WJ./. ..|.G..0..f..........U....P6~.h=....#...|+...}...T.67.Vsn.F.....a...c.k.l.......t..:.(...zx...0.'..,-....;..V^..a".Q..."xZ..`.(6......V..s..........f.fe..djb..*..{#Im......x.)....V<!U~..YG...&c...G.W.g......z..C...x....T..i.......N..Mt...o.iL...;3J}H.n.WY9%.C....q..u....T..!....!...v.3.*._...4....s}.tV.7./...jx.S[..RLH..l..V.4>..../G....t...6.TO..F2..c....I.....Vo....._..k}....&.l..xs..@0..Jw...e.h....mN:.....T?..T...+...L'.>.4..=..kOc....9......H.8..."J?*E..@..5p..[.2oG....z.....F.i.o..........k.W.ub.......Z.7.>..5.e....A.*.*P\.

                                                                                                                                                                                      Chrome Cache Entry: 506

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1398)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):65192
                                                                                                                                                                                      Entropy (8bit):5.62966742878432
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:qwoiR/iuvbWov9tQ/LfiYaKIm0J4FhBb37x8wAj6ObNdCYxnk:qwo4vbWov9L7p4DBb3V8v6OhdCYxk
                                                                                                                                                                                      MD5:6B9BBF6D5961B6C2157B3693950D9A53
                                                                                                                                                                                      SHA1:90CFB3136680815DDF32EF638BDEE5899891ECD2
                                                                                                                                                                                      SHA-256:69B83E36EC7556DDEE62422F0E2F126BF793559DB415E1FB9C75CBA9D751D869
                                                                                                                                                                                      SHA-512:4085F6A64D1E87174FBB2DDF5E0CFFE40ED07E2BE1D4BEA009EDFDBEF40A90268D9E917B946FB44F3F11B029C1EC30E710E3327912DEAE125B279EF5A1D74A44
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=t1sulf"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{.var fwa;_.Sq=function(a){_.Vj.call(this);this.O=a||window;this.W=_.Qj(this.O,"resize",this.ma,!1,this);this.H=_.si(this.O)};_.Df(_.Sq,_.Vj);_.gwa=function(a){a=a||window;var b=_.Bf(a);return fwa[b]=fwa[b]||new _.Sq(a)};fwa={};_.Sq.prototype.xd=function(){_.Sq.Te.xd.call(this);this.W&&(_.Uj(this.W),this.W=null);this.H=this.O=null};_.Sq.prototype.ma=function(){var a=_.si(this.O);_.ni(a,this.H)||(this.H=a,this.dispatchEvent("resize"))};._.u("n73qwf");.var hwa,lwa,kwa,mwa,iwa,pwa,qwa,nwa,jwa,Tq,owa,Uq,Xq;hwa=function(a,b){const c=a.H;return b?(d,e,f)=>c(d,e,f,b):c};.lwa=function(a){let b=a[_.iia];if(!b){const c=iwa(a),d=c.O;b=d?(e,f)=>d(e,f,c):(e,f)=>{for(;jwa(f)&&f.O!=4;){var g=f.ma;let m=c[g];const n=!m;let q=!1;if(!m){var h=c.CF;if(h){var k=h[g];k&&(q=h.H?.[g],(!_.Aca||q)&&(h=kwa(k))&&(m=c[g]=h))}}m&&m(f,e,g)||(h=f,g=h.W,Tq(h),h.WR?h=void 0:(k=h.H.H-g,h.H.H=g,h=_.Yha(h.H,k)),g=e,h&&(_.F

                                                                                                                                                                                      Chrome Cache Entry: 507

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):38212
                                                                                                                                                                                      Entropy (8bit):7.993997570128572
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:QB80RJjSBRg8+aPUNJroK5d+rF8hooqnGdAjkyJb01PFj1s:QB8wqGPpPrpo8hooqGcJbWY
                                                                                                                                                                                      MD5:83AC4CAE8240E1782435213A15B04A1C
                                                                                                                                                                                      SHA1:0A3499F2FC4D410A0B945F77380A76078511D4EE
                                                                                                                                                                                      SHA-256:986500DA5D603A6BAA9E89BE92EBB023231B9B2CDB305D567F715FF1A26FD94B
                                                                                                                                                                                      SHA-512:CF22A837F51964B35F07121E92AA8A5540B67B0F880C7A4EBC1F571F01EDAC950E8D59FB0AB02A0396183753372A4C352589776BB1F3848B3889DA9050419A28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF<...WEBPVP8 0........*..(.>e(.E."....<.p..fm..+..?.VW....w.~..I./Z..............._..w.......V..........?.O...O...............w._eO.?......L.}.#...s......_k......=...t;.......?....]..k..z....'.............O.~z.......o......P..^.........]....../...........O......;.........../....~.}D.........ot.Y...U...........?...~....}.y....K....'.f..~.|.Q...8...rM..Nz..e...e#JJ...i..Eu.`.v..1.....P-..1>5.|...+...$.<W..F.`.'..T......%.....9...)Ry.c<DlD..3.....~.j.....~.z.l......`.Y......ii.Ot...........v..G....."W.p...........r...jA..........8...G......<..O.#7....G..w.....G.=..".+....r.C..5..+.......E.U0.......6{#+.....M..3^k.w.;|.z.....c.<..z.y.........=......O.;/...".\3 ..A..F9.M.c..(3..#.U..5.....i...].3W,..p.xx....>6.[.....q..:)T.f%x.^....V..^mm .}.V)..l.kb.]...@"...'....D.5....o....B.Y.......uu...A/..9:({.(.c.,..C..,.G!.$~=...m\.k...h.O........*.Y...6Zo".^..Sz;.D..r.....z....3M...&.N&8......#{...u.rs..^......()V.G.........0..C.n..e.....'u

                                                                                                                                                                                      Chrome Cache Entry: 508

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):851
                                                                                                                                                                                      Entropy (8bit):7.59394950217953
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:DsLMEeM3lnuDr9Bs1Hk4R3KsGNqA+Mew3FamJAUSGfuNZF0:oLGMRuDrPUE4ssGNlKUFpA7u
                                                                                                                                                                                      MD5:960D040BDA0485B85A657E8154F27216
                                                                                                                                                                                      SHA1:7AE0D56392688470B7979C6F44BEBBB77F601821
                                                                                                                                                                                      SHA-256:B483AC823E1FA188D5D2D05E734E08092656C6013D1CB26B6088FF9100180BE8
                                                                                                                                                                                      SHA-512:C5FA46B46ADEF6B15C99B5246FAB791885707AFFA37ECA40B4F83B3B9D86C94BA5D524AF05B261587A884038AED2F4C61783F26EFD9AE5D5C19249D1A0CF72CE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....szz.....IDATXG.W;hTA.=g.mv... FW$....XD,...E>...Al$h. ....M.?b%.Q,4)...T0).4....`0`.}..\........%!N.x..{.;.....cY.D...m*..m.D..dR. ".B.0cY.7.u.......LNN...l;.~....F......9....UD.H....d...%......b.x..1........K.~.xjY.......i.@D.0.{E.2."..^..@.I^K..#$..9/.@D.A...p.@v.......p..G$...u.4.a....{...b..Z)5....t...<o7.'.v. .ZP...J..L&3..g...I.Ap..)..&.}.p.ls...&.*..=L.R.H...V.......In4.u.q..m...0.n..}U.:.3V.@.....$..X....m.....`..!.....u..|.....<o....... ".>... a.@..{.To&....8......r..F+1....8..*.a..WJ..p.w..@..^..........q].m-......_.F)B.;.f.e......D...". ..K......5f`JD.]..T....0..B.].T...F4H.a#..@7.[..\.kD..|>.Q(....l..(.t.9P..U).."..<o0..i..L.,.1*...r..R..9..rZ.=..n.....slY..d29... .SJ.!i....|'y&.N.7.$.TXA...p}.$.....]]]u......J.U./.k..DD...z._.........r..k:..Tyd...0......j..0...B....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 509

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1872
                                                                                                                                                                                      Entropy (8bit):7.774667148268881
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:++wyPdsTp50W9dEnnX+LX8oa8eoNbAWxj:+y1svOnX+L0loqWd
                                                                                                                                                                                      MD5:4BE5982BBB6815A8C5727375A9F91D9C
                                                                                                                                                                                      SHA1:41C292C69B090BB788599AAD18DC132B057E62DE
                                                                                                                                                                                      SHA-256:F7A3C9CB75D1AD1110755565E9C1C2C8F31C736FB45FD95F54BE15C0E6922B6F
                                                                                                                                                                                      SHA-512:51AAD96F1790FFE4C803840CD1D2B29BCE1B27542163B76831E83B7E77BF0F2225286926E5D148C3B327E1B332E77A5AACE21CF94FD4B9844844B822D8173B2F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFH...WEBPVP8L<.../?...M(l...n..........m.ZD.... ..l".vr.'gJ.+z....L....$.i~..$......T..c..........B..""+.r..;D6.A..J....c.....he..1...z..[.nED......A.tl.v$)...l.h.S..0.L....A.......Sk..2U.]......_nm...}............P.6.J..'b.....9.m.m..T.X.+.....L..6.....$.f...!o.S....>.....'.@. .K..J...&...PP...k...E..I...D..-..Y.......=......d@cg...j.,. ..w.];z.).[.K`.`.n|........}.....i+..6..C0.-.0..y.....z....N.9..$Ku.0P.v..xU........z.-...x.....j..D.3.h..D...$L..._^w}.J..-7.7...@...Z=.@.`...j... ...k.&.............T.[..j.@..t[.......u. .g.&...lz..=.|..._Q.5M..... ...0$g.?... L...v.{.Q.^7...!..8lJ&.a..J...V...@...I!..P.P8Y.3........-W...>]......}<......v.:?...0t.!.-....A..$....z.w.l..~.k...=..b...jme..G.?.c....u.B..u...;y. sh......w+-........Ub.X.X`(..8..... `..j..N.#......C.-.+....X.Z$...D....^!.'.......G..6..:.R]S....@..a...&.b..5q.'..H.....S1P...j*i.t..............C.. ..t.....D......2+..,.A4.d.......r. ...WA.2Q...@b..Y.:.M.UHZ.%e.f5 i.u...W$)f.A*.t..;...b...

                                                                                                                                                                                      Chrome Cache Entry: 510

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):851
                                                                                                                                                                                      Entropy (8bit):7.59394950217953
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:DsLMEeM3lnuDr9Bs1Hk4R3KsGNqA+Mew3FamJAUSGfuNZF0:oLGMRuDrPUE4ssGNlKUFpA7u
                                                                                                                                                                                      MD5:960D040BDA0485B85A657E8154F27216
                                                                                                                                                                                      SHA1:7AE0D56392688470B7979C6F44BEBBB77F601821
                                                                                                                                                                                      SHA-256:B483AC823E1FA188D5D2D05E734E08092656C6013D1CB26B6088FF9100180BE8
                                                                                                                                                                                      SHA-512:C5FA46B46ADEF6B15C99B5246FAB791885707AFFA37ECA40B4F83B3B9D86C94BA5D524AF05B261587A884038AED2F4C61783F26EFD9AE5D5C19249D1A0CF72CE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/footer-icon-4.png
                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....szz.....IDATXG.W;hTA.=g.mv... FW$....XD,...E>...Al$h. ....M.?b%.Q,4)...T0).4....`0`.}..\........%!N.x..{.;.....cY.D...m*..m.D..dR. ".B.0cY.7.u.......LNN...l;.~....F......9....UD.H....d...%......b.x..1........K.~.xjY.......i.@D.0.{E.2."..^..@.I^K..#$..9/.@D.A...p.@v.......p..G$...u.4.a....{...b..Z)5....t...<o7.'.v. .ZP...J..L&3..g...I.Ap..)..&.}.p.ls...&.*..=L.R.H...V.......In4.u.q..m...0.n..}U.:.3V.@.....$..X....m.....`..!.....u..|.....<o....... ".>... a.@..{.To&....8......r..F+1....8..*.a..WJ..p.w..@..^..........q].m-......_.F)B.;.f.e......D...". ..K......5f`JD.]..T....0..B.].T...F4H.a#..@7.[..\.kD..|>.Q(....l..(.t.9P..U).."..<o0..i..L.,.1*...r..R..9..rZ.=..n.....slY..d29... .SJ.!i....|'y&.N.7.$.TXA...p}.$.....]]]u......J.U./.k..DD...z._.........r..k:..Tyd...0......j..0...B....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 511

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):37658
                                                                                                                                                                                      Entropy (8bit):7.994897732347311
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:TcLp/YW4i3iSAv1E9R6rYhOsr+yP/xImd8BIB01iP8mks18VK4y5:AGsFAvwgrjYNPqmhua0K46
                                                                                                                                                                                      MD5:7090B63ACBEC7EE45513BDDC66AD4830
                                                                                                                                                                                      SHA1:08DC4311CA095FEA0628CC8A8123DE300C6F084D
                                                                                                                                                                                      SHA-256:41799BFEFFBEFD1B0A4EFC6AFB98EB7BCFC96319A00DC81A9896942738ADDC2B
                                                                                                                                                                                      SHA-512:59CDDAFDFE470FBAE2D08B1DEADADA9CAAAAC576B5E06797A82E4B65FADCE9B845EB9F89F87FBCB632E39AD79774B939E16D710D145769AE3726F8BEF663C6C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/HWLjniFTfQGv7vGmbKuTolmVb5NYNfXCDhDynfDqX_yc8UnMr0YZhxNfl-2zrLUpjw=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."..j.@.D.5x.C....#. DH..3,..g.. ...>p....>..k...|W./5.......W.............../..'......J~...{..........o....._..z=.?......Y...%...k....?./l................4?U.s..w...q.S./7}.}#..........!.#......}..._..............{......?....9.#...............}d.C.............?........?./.............O............#.....?n..}K...............E.g......g.....?._.??.;.0|..Uy..m.u.W..{..9"c...sl....(..&....N..f.....X.rXu.L?m.Z.z......bt.sO.R.9......;...K=[Q?...e...T=z)..D/..L6..Z.........X5Y..1...ir}.T../.,J.F..Z..x,;..YZ...,...\.d4..}...n...s....(...z...D.G.j.Qo..0...u.%Zp......K.......!..(..Ew...S...)EVP.*].....y[..!.K5.Y ..T....'....G...`.h....4.z.d.5[<.".#.#...;..#.y.....f....c.....ZW..."...U..#....\<n?.{b....{..qQ..B.'.O$v...L$^h.U..........Rc...6....^4EwC.`>r2.C%.oBL|eG....[.Z..F.e.....ov.J.[O.\..Q".....!..5.....3../A.k./X.:L..5..e2....?%...?/e...,...D.IJ..gs....z.............P$.Jw..T.......ra..).../.._f8.h.\....

                                                                                                                                                                                      Chrome Cache Entry: 512

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (539)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1521
                                                                                                                                                                                      Entropy (8bit):5.153012792003547
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:kzeN2dRS/mQhuFnw2qgwK+YPiFocoqjk2faBcJauPKerl:kkqFw2TWgmbY2aBSayrl
                                                                                                                                                                                      MD5:D310E92B496A39DB1A9490E049540383
                                                                                                                                                                                      SHA1:3CDF9141F1F7BC8BD6C5F9C68897FD3ED9E28FCE
                                                                                                                                                                                      SHA-256:56436DA9659558912E6612ABBA1F0B1785EAF8E96E7BD9E8E31FAF9A0E5121F4
                                                                                                                                                                                      SHA-512:9485A2F0FFFB19AA13F18DA8344A2B23ACC8162B24BE3089D138AB9DC8E95E4508B480FA92274137CD49E85A8914996579F85882E1F4229D8587D8099CD27989
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.IEa=_.B("IniPib",[]);._.u("IniPib");._.lrc=class extends _.Cq{constructor(a){super(a.ua)}};_.Dq(_.IEa,_.lrc);._.w();._.JEa=_.B("yABLaf",[_.Rd,_.IEa,_.Dj]);._.u("yABLaf");.var mrc=class{constructor(a){this.element=a}addEventListener(...a){this.element.addEventListener(...a)}removeEventListener(...a){this.element.removeEventListener(...a)}dispatchEvent(...a){return this.element.dispatchEvent(...a)}pause(){this.element.pause()}load(){this.element.load()}},nrc=function(a){a.O=(a.video.element.play()??Promise.resolve()).then(()=>!0).catch(()=>!1)},orc=function(a){a.O.then(b=>{b&&a.video.pause()})},prc=class extends _.xs{static Ja(){return{service:{Pf:_.Oq,bja:_.lrc,window:_.sr}}}constructor(a){super(a.ua);.this.H=0;this.O=Promise.resolve(!1);const b=this.na().ww();this.video=new mrc(b);this.window=a.service.window.get();this.W=_.gi(a.service.Pf.get("Qrnzfb"),-1);this.ma=this.W>=0}oa(){thi

                                                                                                                                                                                      Chrome Cache Entry: 513

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (2358)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):14976
                                                                                                                                                                                      Entropy (8bit):5.67171302650422
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:2Aj57nSJyC9lHwO0Bx2Ckwlf6VrI3dq15N2ap3NRI3X3ZA7shBa2SuS:NC9lHwO0X2CdJ6Edq15NRp3XgXp84a/9
                                                                                                                                                                                      MD5:55CFC6704F3C35CFF76887CEF7BEE0FC
                                                                                                                                                                                      SHA1:579FDF296ACAF8CFB8AE85989E17FE22995307A9
                                                                                                                                                                                      SHA-256:55043EC5593C1CF298833F161641877C8E2BBD5F3F026B95717EF4D1E40A3B18
                                                                                                                                                                                      SHA-512:1E5BADE819038B35A8FC6045D7139A2F0080BE5EC9BBE2C0DA7DF33A8628D22223D44293F44EED2BEA449518373352D5B5DAE822B37B05C5FA666674F7682AC0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,C7s1K,CKm2Wb,DRmmld,EEDORb,EFQ78c,ElYdAc,FoxcOd,FuzVxc,GjTCAc,GkRiKb,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fPcQoe,fdeHmf,fl2Zj,g6aYuf,grWkAb,gychg,hKSk3e,hc6Ubd,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lDZ2Fb,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=CvxVpd,gKWqec,M2Qezd,jZ2Ncd"
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".YALzif{background-color:black;height:100%;left:0;position:absolute;top:0;width:100%}@media screen and (min-width:840px){.YALzif{display:block;height:480px;position:relative;width:853px}}.wnr67e{display:block;height:100%;overflow:scroll}.Q0klLb{background-color:black;height:180px;width:320px}.nFP0jc{left:0;margin-top:20px;overflow-y:hidden;width:320px}.tqorv{align-items:center;border-bottom:1px solid grey;color:white;display:flex;padding:24px 16px}.jKAqf{max-height:406px;overflow-y:scroll;padding-top:16px}.lKf3F{align-items:center;border-radius:8px;display:flex;height:80px;margin-bottom:4px;padding:16px;position:relative}.Jamhv{bottom:0;height:100%;position:absolute;right:0;width:100%}.lKf3F:hover{background-color:rgba(60,64,67,.5)}.vbwGKc{border-radius:8px;height:48px;width:48px}.o1lVq{font-size:1rem;font-weight:400;letter-spacing:.00625em;line-height:1.5rem;font-weight:500;letter-spacing:.25px}.nK64Q{margin-right:8px;height:40px;width:40px}.ZcwU1{font-weig

                                                                                                                                                                                      Chrome Cache Entry: 514

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):38212
                                                                                                                                                                                      Entropy (8bit):7.993997570128572
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:QB80RJjSBRg8+aPUNJroK5d+rF8hooqnGdAjkyJb01PFj1s:QB8wqGPpPrpo8hooqGcJbWY
                                                                                                                                                                                      MD5:83AC4CAE8240E1782435213A15B04A1C
                                                                                                                                                                                      SHA1:0A3499F2FC4D410A0B945F77380A76078511D4EE
                                                                                                                                                                                      SHA-256:986500DA5D603A6BAA9E89BE92EBB023231B9B2CDB305D567F715FF1A26FD94B
                                                                                                                                                                                      SHA-512:CF22A837F51964B35F07121E92AA8A5540B67B0F880C7A4EBC1F571F01EDAC950E8D59FB0AB02A0396183753372A4C352589776BB1F3848B3889DA9050419A28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF<...WEBPVP8 0........*..(.>e(.E."....<.p..fm..+..?.VW....w.~..I./Z..............._..w.......V..........?.O...O...............w._eO.?......L.}.#...s......_k......=...t;.......?....]..k..z....'.............O.~z.......o......P..^.........]....../...........O......;.........../....~.}D.........ot.Y...U...........?...~....}.y....K....'.f..~.|.Q...8...rM..Nz..e...e#JJ...i..Eu.`.v..1.....P-..1>5.|...+...$.<W..F.`.'..T......%.....9...)Ry.c<DlD..3.....~.j.....~.z.l......`.Y......ii.Ot...........v..G....."W.p...........r...jA..........8...G......<..O.#7....G..w.....G.=..".+....r.C..5..+.......E.U0.......6{#+.....M..3^k.w.;|.z.....c.<..z.y.........=......O.;/...".\3 ..A..F9.M.c..(3..#.U..5.....i...].3W,..p.xx....>6.[.....q..:)T.f%x.^....V..^mm .}.V)..l.kb.]...@"...'....D.5....o....B.Y.......uu...A/..9:({.(.c.,..C..,.G!.$~=...m\.k...h.O........*.Y...6Zo".^..Sz;.D..r.....z....3M...&.N&8......#{...u.rs..^......()V.G.........0..C.n..e.....'u

                                                                                                                                                                                      Chrome Cache Entry: 515

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):79826
                                                                                                                                                                                      Entropy (8bit):7.9760101657223546
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:E2XnNcR4R7Gqccjo+bhuUZ5tmQ0aYUWOl7pQAxsALYwYnvUUiUuK16cOq6CWgu:9iGRZPjo+1DZPmQrYeppQSzLYwoUUiUA
                                                                                                                                                                                      MD5:A479E1F625B44C5B7A2DDEBC20B2CB11
                                                                                                                                                                                      SHA1:A43FD972ED37115B2B8C42E78512A25936B43356
                                                                                                                                                                                      SHA-256:5A682C84ECA4B472A7823B3B51072B7994C3FCADC8AFE8882E029676CEF8CEFC
                                                                                                                                                                                      SHA-512:221B113407F0B0497BF06AFF8E6C7EC5C7058AE11913B496A39AA20B399CA3F94891460D91BA73E03F3C5C8988999094520B90C81005A554A1D223E15F20DD11
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/ayEFwVZElGwAqSC4_lBrJNCJC7ayciaky2Qp7eOJqHHLjorWDgRsa_cKepjhc0d5xg=s256-rw
                                                                                                                                                                                      Preview:RIFF.7..WEBPVP8L.7../..?.M@.$7l38....._0..........s..y.:......Z..9g...#By.~....j{..v...s..?..T)].O......}.m.../.9..}M.]U./8....s...A6v..`........:......Q...v7....).@..=3.....#YMwwU.x.<...fV..2.g....t. .{f..!;..2.."....../13...`*........Z...%.f&"2......$...ED.00x...&.:".#:s...f..t.~.|.....zOG..<.>R....j....DJb..IU.'B{...%.2.....^.......J.I.I).!...7[..$!tUg:......:.3+yv.....8..)3+_...3.8G....!I...Z........}..V.T..@=..c..&|.#>..8..B.j.q...1..}..d\.!+..2.V.!>.#h...6......J.....Z..s.z9t../........m.I..S_!.)R....C."Q ....`..<_8...!.l..X."......(.V4..3.....Qv.....L.B.[..Z.~.2.L..Z..a..P..)7..r...6.C`-.RR.)..k=...3`a.$.....R..BH.R....a..W^Y...\X.l.. ;......C.y'.B..^=.!U.....".R}...?.......A...S=.t.9....|w{T#P.I.*.. U*2.*.......CO.C..t6.!......O........Y........c...[.f..:.2..R.@..d..K.\.B].....\ .^..(}.'..~....{.v....'bMn..^.R.=.L!.S.....0.8d..\J....e]..k...x..............E....Ku. ....-X.....*6#~.j..)*Q.....8o8j.......K!&..o.;AE..Qx

                                                                                                                                                                                      Chrome Cache Entry: 517

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3817)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):122923
                                                                                                                                                                                      Entropy (8bit):5.472299399758699
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:KAIcfKjLatJdHL6knxNEWKeNhSMu64zsibf/GZA50frNNyhAnY/iBl6Jap+a3U2Q:PIyKoncFMqH/GZv2ap+atK8C
                                                                                                                                                                                      MD5:675F3BFBA67EAF37FF1A747084B9D35D
                                                                                                                                                                                      SHA1:017F8D67C92C67E480A004535800A41D2F1FE78F
                                                                                                                                                                                      SHA-256:E643FAD6C7DA22675E44A57B206C5D7CC0E2528CEFAE6CB8858D128DCD98A5D8
                                                                                                                                                                                      SHA-512:9C982BF214F0D338A2DD413EE35D8C2A2E8B7468BDB064F869E98415F4546EAB5CA7A50072BDB55FDA51C0D8A7132BD6046C21EE8D5165305C1BAD608C6D6E2D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
                                                                                                                                                                                      Preview:(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},t=ca(this),v=function(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.v("Symbol",function(a){if(a)return a;var b=function(g,f){this.$jscomp$symbol$id_=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.$jscomp$symbol$id_};var c="jscomp_symbol_"+(Math.random

                                                                                                                                                                                      Chrome Cache Entry: 518

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1439
                                                                                                                                                                                      Entropy (8bit):7.366400051072136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:/oamZAnlD521IDX3m94+3mOtC0mx8cbiF7sK/JLmpUO9b3lo9n2sTWKercWljn+q:/obyoIF+3mOtC0mxE7f1eUo3SRHTccKP
                                                                                                                                                                                      MD5:7B11876073896E5C656E0B53EC8D57D0
                                                                                                                                                                                      SHA1:D7892EDE82AA15D09FE9D07AD8BF268EDCE004D7
                                                                                                                                                                                      SHA-256:77ACCA664CE8F08FCD44DB03E5738E57F2BE9713C2373AB83182F898937000B5
                                                                                                                                                                                      SHA-512:8FB4E6880206AED53D8A081807965BE989C422DF404F3426C8087C9B8082C23A571D2DD48B020EF1B99325D420A3F6254D64EFABC6E36F0238E4535BAF20FB33
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/free.png
                                                                                                                                                                                      Preview:.PNG........IHDR...@...@............:PLTE....................................................................................................................................................................................................................................................................................................................................... .. .. .. .. ..!..!..!..!..!..!.."..#..%..%..*..,..,..9..9..<..>..@..B..C..E..K..N..W.._..b..c..e..r..t..x..y..|......................................................................................................................................&...QtRNS............ !"@BJKLMNOPRWY[\hijkwxz{...................................................bKGD...-.....IDAT.....C.q....)Or..H....NBD9.1......eo.;{e.............:E..2(..:......@69.z......,s...`....A...D.3.).."DQ.b.FT...M.p.T.O.ica...E.0..x4R.....]Ie8,+ ...!.L..aCU...a.h..@....(.....0.x.......f3.d..&.....a.FF..>.../......;8.../....t..+.r..d..k8`.2.X...j^B.@m4

                                                                                                                                                                                      Chrome Cache Entry: 519

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):23781
                                                                                                                                                                                      Entropy (8bit):5.23295264757458
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:YE7RAyt/smRdJgXdxFCkFmY883qF121O87aDvuB4Y4jkma0Udp6Giy6Io6uL6E5o:xRdMdxFLFmM7ci4jbaZ67y6Io6L86
                                                                                                                                                                                      MD5:EF93C686E0E2B7430912CA1D0C2766FE
                                                                                                                                                                                      SHA1:3CFC713E766163A331ACF4655FE9C7D97E278500
                                                                                                                                                                                      SHA-256:04870310E9D1E0849F6E63AB95481C977B75FD1DE9098C1CC471AF98C2FCA3D8
                                                                                                                                                                                      SHA-512:4304AC41235F794930B82E24C2E977F46F906D71ED295EDACD5F8396D0ED59B1C0B87A9EC8DFF466405A317D433F2E4A12165C226434ABA140DAD82B04F9C4AD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="692" height="579" viewBox="0 0 692 579">. <defs>. <clipPath id="clip-path">. <circle id=".._1" data-name=".. 1" cx="36.068" cy="36.068" r="36.068" transform="translate(0 0)" fill="#a7c3ff"/>. </clipPath>. <clipPath id="clip-path-2">. <circle id=".._2" data-name=".. 2" cx="36.068" cy="36.068" r="36.068" transform="translate(0 0)" fill="#cbdbff"/>. </clipPath>. </defs>. <g id="bottom" transform="translate(-752 -241)">. <g id="._149" data-name=". 149" transform="translate(767.934 268.316)">. <ellipse id=".._3" data-name=".. 3" cx="83.655" cy="18.211" rx="83.655" ry="18.211" transform="translate(13.072 488.396)" fill="#c8daff"/>. <g id="._19" data-name=". 19" transform="translate(45.625 65.552)">. <g id="Big-Laptop1">. <path id="Path" d="M7218.1,3285.341H6809.389c-14.435,0-26.242,10.825-26.242,24.273v249.62c0,13.449,

                                                                                                                                                                                      Chrome Cache Entry: 520

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (13551), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):13551
                                                                                                                                                                                      Entropy (8bit):4.969433468752002
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:n9Ttv4d5mJMSBbyJMtkriRQrWeIAVvLDSFaOfE4+moxa8+c5J2pFmbR5B:nJfkhrtIqLDSFaOfE4+moxa8XWsbl
                                                                                                                                                                                      MD5:651BD4D9AFF38B4436F8AF9DBF1C31E2
                                                                                                                                                                                      SHA1:81C02D680BCB7B0C588202C41359EEDA9A23401E
                                                                                                                                                                                      SHA-256:89B54EDA872461074769E6D8F7551E574127DB61E39BB34CEB704DEE42CE028C
                                                                                                                                                                                      SHA-512:00400419357E1414876F1B7973E000FE77F8C89D2AD22B5BCB80782E446E0473E6FEDE2AE7BC34B7E91669EBFE2BB78FB68610EBEB0F29C3CDB67BD5A26F7875
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/css/home/index-v3.min.css
                                                                                                                                                                                      Preview:body{background-color:#fff!important}.main{position:relative;padding-top:50px}.overflow-hidden{overflow:hidden}.main .section-one{position:relative;background-image:linear-gradient(to bottom,rgba(255,255,255,0) 0,rgba(231,234,243,.5) 100%);background-repeat:repeat-x;padding-top:30px}.main .section-one .banner-bottom{position:relative;z-index:0}.main .section-one .banner-bottom:before{content:'';position:absolute;left:0;right:0;bottom:0;height:10px;background:#fff}.main .section-container{position:relative;padding-top:158px;padding-bottom:90px;z-index:1}.main .container-header{width:1200px;margin-left:auto;margin-right:auto;padding-left:15px;padding-right:15px;box-sizing:border-box}.main .container-header .row{display:flex;flex-wrap:wrap;margin-right:0;margin-left:0}.main .container-header .left-content{flex:0 0 50%;max-width:50%}.main .container-header .left-content .title{font-size:56px;font-weight:700;line-height:66px;color:#1e2022}.main .container-header .left-content .title span{co

                                                                                                                                                                                      Chrome Cache Entry: 522

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1168)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):19055
                                                                                                                                                                                      Entropy (8bit):5.641313119370284
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:iavkvyX8WBVDB/vPovschgFNad27Ih+ybKQhvUpel6b3ERwggOPH69RNV+/as4D0:iavkaX8cDpvPovscuFNaM7Ih+6KcvUpy
                                                                                                                                                                                      MD5:40D3F728636F2CBD23C0174842236744
                                                                                                                                                                                      SHA1:DFD89C1AA0EC92DB7AF36CCBE1944029884AF49A
                                                                                                                                                                                      SHA-256:A3173514C3094A6751540466629A87DF335C4F5DBF97CB59A717B15E83CA1131
                                                                                                                                                                                      SHA-512:ACF06CB56382CE4C89B3D7BF61524C0057B6B97B6951FCAFC248F19EDE6DB5E140C20B6A2A7FDC2369D28E20618C189348350A821EA5A49060B770AB8BBAA1C4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.rf(_.upa);._.u("sOXFj");.var pxa=class extends _.Cq{constructor(a){super(a.ua)}H(a){return a()}};_.Dq(_.tpa,pxa);._.w();._.u("oGtAuc");._.gxa=new _.ae(_.upa);._.w();._.hxa=class extends _.Pk{static Ja(){return{Tl:{aZ(a){return _.Jd(a)}}}}constructor(a){super(a.ua);this.soy=this.Uj=null;if(this.Qk()){var b=_.Hj(this.Zh(),[_.ek,_.dk]);b=_.Pe([b[_.ek],b[_.dk]]).then(function(c){this.soy=c[0];this.Uj=c[1]},null,this);_.Qk(this,b)}this.Oa=a.Tl.aZ}fp(a){return this.Oa.fp(a)}getData(a){return this.Oa.getData(a)}jr(){_.ml(this.Uj.jf())}eH(){}};_.pr=(a,b)=>{a&&_.ce.Fb().register(a,b)};._.u("q0xTif");.var jxa=function(a){const b=c=>{_.Yk(c)&&(_.Yk(c).qc=null,_.ar(c,null));c.XyHi9&&(c.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(let c=0;c<a.length;c++)b(a[c])};var kxa,lxa,mxa,nxa;kxa=function(a){const b=a.Ya();return(...c)=>a.Sa.H(()=>b(...c))};lxa=function(a){const b=a.W();return b?(.

                                                                                                                                                                                      Chrome Cache Entry: 523

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (5945)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):265791
                                                                                                                                                                                      Entropy (8bit):5.5725446117659025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:KjJpmFU7Oli04d7G3BsEemvevNnH0fxnQ6:YyW7O4nhiZ7
                                                                                                                                                                                      MD5:1866ECF9F33657D40EEC60663E142E57
                                                                                                                                                                                      SHA1:AC22998D4AE718ED80F2144CBA5EAB3294B14147
                                                                                                                                                                                      SHA-256:0C6D2D740F9D68C00FAC748AA230B6C3B348C70FC08E279E37E1F9CEAC39510E
                                                                                                                                                                                      SHA-512:060206F9C331C02A6791EADE1E40C8544CAADAED397D655F74988611693131DA5A2A07815E6270CEA5BDFC13CB61987338AABD05F05DF570535DB4710554237C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"6",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":16,"vtp_rules":["list","play\\.google\\.com"],"tag_id":10},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","play\\.google\\.com"],"tag_id":12},{"function":"__ogt_dma","priority":6,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":13},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":

                                                                                                                                                                                      Chrome Cache Entry: 524

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):34940
                                                                                                                                                                                      Entropy (8bit):7.994451784363584
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:N7MwsSC+EZ15Hl/2nia9Hv41MOe3YMXEw2RTkAlkZMuNyjT:N7bsFHZ1D2X9P42CMXEwqTkmE3yP
                                                                                                                                                                                      MD5:DE5E627A8A024570E8659D48032C77D0
                                                                                                                                                                                      SHA1:62A502B8F70D42BE27F9CCF5AFDD686E17C8801E
                                                                                                                                                                                      SHA-256:2D32088635E533B4EA238BD1020A4E131CA7299947EAF996B135BC892999A308
                                                                                                                                                                                      SHA-512:B97FCB7C9E6C0BA2F7D3639262642921A359440D2C8A0AC73760D11B88FC4737793530162DF64C518BBB6A16DC2D485DE6263980B73AE0B2DF1F42B5824D2E3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFt...WEBPVP8 h...0....*..(.>a(.E.".....@...4...........|.qP..}ih)..~.y..|.x.............?..l]3..._.....>..].....r...w...o.?.?q.....{..../.......].......~.zt.....a...W.O.s........l...../.........7........q~.....W.g.........O..(...k.#...?..;.+.C..../.w.?...........\?u.g........,..o..........?.'...._......U...?._.~....z...[..........._.O....V~^.@......(`.....G.uM59..gC.X......:.Ng;..f..kD.u...<..DU<.3.q-.9.+....nL.US....b.7}s..m....7...=S.8.y..3...[..1...JI.fB.W...S..].Q...D..Q*..l.a..Q......z~.q.M......G..O.....I...h-,?P~&?/..E%{\...m f..C..'.-....%....+.h......KKe:.6...#>Mz..0.u.x".-..o...t%9...4.&..p.1..Ga..P..]TQq...........}M...vu.....rOs.?.V;...M.,.Z.."e...5.p-....$......,v.O+....n.# ...[>.~....@..g.|K....h..m..h..k....v.g:]%{1XY..........:..d..qM.r8:....1,....y......V....ME4..ti.....0.&....aUP.e.....~W...r.m..iq.P.%9..z..|,r.....Oq..W...9.....!.V.....N.a6.j...f?.......:..Q.u......4..G+.X...k|.............}..]...UR.8..@2_..!Iv.E..y..s.}....u..

                                                                                                                                                                                      Chrome Cache Entry: 525

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):86952
                                                                                                                                                                                      Entropy (8bit):7.9969412048808985
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:1536:Y2Jgn4o/EQo5EH4zPLQC35S6mzgth4dwxX8clPa+wgyQ9hXJD+0prxndmH5R:Y2JU/Exo8Lb35S6Rv4ds8cxwgy2X40pK
                                                                                                                                                                                      MD5:5C05C9598B9EE99C88672680584F8BDF
                                                                                                                                                                                      SHA1:5EA0C74D794A754D31F39052F05B76A14A1BB14D
                                                                                                                                                                                      SHA-256:51736A81D661E4851CC415BE72D56BD1917DE7FDB708EFAD43A605AD26D9B596
                                                                                                                                                                                      SHA-512:C13C6D51D24DEB5B4B7E8A2119B074969D0052E707F5441E65C7A2ADC5943E5CD97DFEFC3375ADF252E41694AAC5A9AAA41C8CABE72FAA6083F7654B32578770
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/pQqL4JTm_4PS4UGdvVNnv4f0AYXeRwItrhlAhu84_jtUO-xslQmRaHgrJouYh82OPps=w240-h480-rw
                                                                                                                                                                                      Preview:RIFF.S..WEBPVP8L.S../..;.M@l.6l..VdF..........*(...$..9..O.$..vN.e...{...f$;.sFC..y;<........y...%..w.].M.:O.."...$G.....s..6......e..-..K..O'.If..%$]..Nv...k.vf..oB`...=.\+........][jt.H...M..#....m...;.J.......&..&.:.\]e.]I.$...J.R.*,...0..^d.g......KR*......Z$..Li.... ig.&....3}...>...=.3.8..H...J.f$..Se`.}....s ./&.{.-U...U#.$......*I".....n..8.;.OTW........69<..l...o.%...n.m.g..a.!I|..H.....-..I.F.@.E..{o...?.... .. ..q..q.s...j{..Z.3.c.1.%=s.....e.}..f.0B.!(k....uRn..a=...?.Z..R.r>..I.d.?....-..+..."#g-.,G..T..[ET(.E..)KYD\......@x.......r.//..\....%G..$.....PZ.[F&i...{dVf..4.o..W.5..m;.].1......3qb..c1..x.^..]M(.X#.....s$..:..7....z.U.d{......4...Q..+p8hX.kH...Ba...9e.d.=...O.O\..nv.....CADD....7.G...c...?..\.....g{0.@.J.'.2....G.0!.P.Rtny...y.+....qX...!......-...|....6..z.;..^..D.,.##.Rr.y.e*.......Q.(.;7.U..+........Xj..+Z-.b.Y.@.Lo....... .>.......7...F.Q.R...k.}(l.)E$....jI4...k..K8.....J<..A|6.2.>.G...6G.y.....H.D...../.

                                                                                                                                                                                      Chrome Cache Entry: 527

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):37658
                                                                                                                                                                                      Entropy (8bit):7.994897732347311
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:TcLp/YW4i3iSAv1E9R6rYhOsr+yP/xImd8BIB01iP8mks18VK4y5:AGsFAvwgrjYNPqmhua0K46
                                                                                                                                                                                      MD5:7090B63ACBEC7EE45513BDDC66AD4830
                                                                                                                                                                                      SHA1:08DC4311CA095FEA0628CC8A8123DE300C6F084D
                                                                                                                                                                                      SHA-256:41799BFEFFBEFD1B0A4EFC6AFB98EB7BCFC96319A00DC81A9896942738ADDC2B
                                                                                                                                                                                      SHA-512:59CDDAFDFE470FBAE2D08B1DEADADA9CAAAAC576B5E06797A82E4B65FADCE9B845EB9F89F87FBCB632E39AD79774B939E16D710D145769AE3726F8BEF663C6C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/_DfAhmzZvYJ8GpNEE0u4tZYC_n3kKcBXg1TS0r7B9eKbRR1wgzUvqZQQJgJJS1Exmw=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."..j.@.D.5x.C....#. DH..3,..g.. ...>p....>..k...|W./5.......W.............../..'......J~...{..........o....._..z=.?......Y...%...k....?./l................4?U.s..w...q.S./7}.}#..........!.#......}..._..............{......?....9.#...............}d.C.............?........?./.............O............#.....?n..}K...............E.g......g.....?._.??.;.0|..Uy..m.u.W..{..9"c...sl....(..&....N..f.....X.rXu.L?m.Z.z......bt.sO.R.9......;...K=[Q?...e...T=z)..D/..L6..Z.........X5Y..1...ir}.T../.,J.F..Z..x,;..YZ...,...\.d4..}...n...s....(...z...D.G.j.Qo..0...u.%Zp......K.......!..(..Ew...S...)EVP.*].....y[..!.K5.Y ..T....'....G...`.h....4.z.d.5[<.".#.#...;..#.y.....f....c.....ZW..."...U..#....\<n?.{b....{..qQ..B.'.O$v...L$^h.U..........Rc...6....^4EwC.`>r2.C%.oBL|eG....[.Z..F.e.....ov.J.[O.\..Q".....!..5.....3../A.k./X.:L..5..e2....?%...?/e...,...D.IJ..gs....z.............P$.Jw..T.......ra..).../.._f8.h.\....

                                                                                                                                                                                      Chrome Cache Entry: 528

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15742
                                                                                                                                                                                      Entropy (8bit):7.987435431620976
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:rSgE/rsWBEBVleHQZk5PtkJ8ydwFMQbvEnSideDbE:WnrlBEBVliQSPtkJ8AwSQjecQ
                                                                                                                                                                                      MD5:0CA92FFEFA961F83064FE5FEE52C99DD
                                                                                                                                                                                      SHA1:59C5D5F1821274B00E103DBA07CDDC857C4B42A8
                                                                                                                                                                                      SHA-256:F32E8E7F4D7DAA42569D62624C20063A956DBCA27A660BF0F0B28BB55F419CE7
                                                                                                                                                                                      SHA-512:3CBD1FE45B04240F6A00560722759D17A0C77F1F7B2B11FFAA3AF744907DEF510643B8FE2D90BAC3135FF29749BC4AAFCB2DEC71BA57E0BDF6B7B172CD0CC490
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFv=..WEBPVP8X..............VP8 .=.......*....>i*.E."../6|.@..h.p..ge.....*}..?.?.......ky.t_.?........D.7.o......V../R.......7.K.#.....oP....z.=..s.:.u...................C.."....G?$.&}.j;.r?......~........}.....z......r.3......._.~.?.....'..........R........./...O.....?.{.........;..9"...l.P..S.......Bg.k....7..MO#/.n..u.^.Qi.l.Z.....y'bw.._.w/..9}I6.d.......0<..Y5.Y..^.....$Y.."....M...h..5..kqk.Eg.....4....H.3.1<.......P...}.E...@.*Y.........=4.E..........c.(...p..l...zJ{..,..[V`..|.:.A...`4..z..<...S.....]X.9_...3.;...o.Q(....>&.>.O.....Kn^.E.ZP....,...G....F].l_.y......W....V...Z:.Om;./..7E.t_.Z0..-JV....*.J?V....I..K..y.h.2X7.S.(R.F;@..>.."cZ.../=.(X....*;BX-X<.h?L.6...4?.%.<.5...T.dx;kx....p......o<..7R.e~.2.........*Aw.F^..7.,...7.o.yY.W.....oY.B4W.U.......D{;.....l3.c..#.3g.g.,.p.....].=.M......y...2.(..../4.w=a.<. .H8y...y.9K..t......>(..G.......c....J.<.:.....cx.......t~C..|.v9...n..`:..Y.h...L.&Z...^m....".......?..s..eR..<.9bt..

                                                                                                                                                                                      Chrome Cache Entry: 529

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):10976
                                                                                                                                                                                      Entropy (8bit):7.971626582681124
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:T7w6vtlMEwNgHAZ2TokDc/2rmmx6AAjFC7cz5RHVvSjuRDU+T62oVFF2:Ts6vtlJqggYToq76AAjU7eEjODUc4jk
                                                                                                                                                                                      MD5:BBBD4BADE7B797983D02E822418CA387
                                                                                                                                                                                      SHA1:23F5227C99B6C719E19A72D7AE3E21F0B8110457
                                                                                                                                                                                      SHA-256:516154F6357DFD7740297F8657E75F0095C9EFD390BBADBFD8CC981E02610D9C
                                                                                                                                                                                      SHA-512:7D711C2E28B820DF6503605B0550C255C9DA2D0C3B7E4F1920B172E42837EFCA4A0D426D4F334DF7A1ADCCE6EACCD0B95D35AE2AFB046694D70563BEB16883FC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/ZCZNW25jtVaC80VXN_robPf2q40eFFQzLvH3NHA3fK1HZACAOd4-hnMZc7Owj-cn5Nw=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF.*..WEBPVP8X...........'..VP8L.*../..I....m.i.............@9.r....]..v...wn....Kz.W..w...{.q";..^/Qz...M..N.}{z..63...K...;J.i....j..A/. 4.A.......n..?C.o...\.Q..M..f....v..j!.K.P@.Kz..R.n.1i...2.y....J.i .h.d...j.P(.BBy..r(.aKn$.$...G....7.."Ir$.c..<..ZLw...(M..Zr^..f.m.m....5....yW=...;q....Jo Ug..[Y.z....Y.>....m.....F.U.m.m....-.0.......m.m......?....T...FZt...}R.K.M......0....M]&.[0.m.kE...F..SL0....v.-...N.lP..(....Q]..q...v..o...hPq......q.[L......7uZ...m(...*...R.....Y..D.A.$..B._....s..,.O........R..%~...$.v...<jr..[..o.>..<...&}...XGu..g\.nM.h.k.y.f...C.H.g.. .a...Q..YWeH&...C!.s.....z...0.O....3l&.....$.Q...".B.H..\.tk..'r..(R.Q..#..O...D<.j5.(....u.n3.....#..c......@...-.;....L....M.>.......^...j....^;.fr./..LM..f.}u....*....k.z.%.....0}n._.Q..\.......(...u....UG&%.U.w..i...o=........Ip..Ob..\u..m.. ......VI....c......5U!.F...z...s..(...~4.....e...{>j.lEZtT.q....Ff.w.....G......4ij.=lx.g.|...7...c./w.3T&....noE..

                                                                                                                                                                                      Chrome Cache Entry: 530

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):34736
                                                                                                                                                                                      Entropy (8bit):7.994831968088191
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:03n7+TtVLG50DX3C0/P+0/hCstO05hP4qK65YgFrXLfBBUmBo:037MeKX3n+8g05VsDgFrXLfwoo
                                                                                                                                                                                      MD5:9F6E8DDF058E07392417009FB91BB655
                                                                                                                                                                                      SHA1:B97A6FD4756779522EE7E1098276478E8EC29E3B
                                                                                                                                                                                      SHA-256:E8ECF31ECAA90B199C1785ABF0FC22B6582081378CB23BF5BB3CEE5C4357866A
                                                                                                                                                                                      SHA-512:8FC862162CA1FD8531B4D8CE4DC22346DED71B13A75B3AA44BC2ADE88AE90A2E18954AD99EC383AC49B411E4B3233803FECE2C8C6941DD35D85502901D7B67A2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*..(.>](.E....+.;p...di....a...~.Y+.i..?3=.../.~...........n=5........^.Z.....m.........c...'.........?..j............{.G.k..?.?..............?..g....._._7.....~p...?....T.....S.'....U..w....z../._..5...........<?{.S....././...........`?..........u.....?......k........^o...?t?.......?.b...a....LAs....a.ed.. ..9.[x+qt..#...MP..4X.M.L.`\{.vs..........dz.2.Sq.......L..).ciu....Q..b....L."{...4.j..[Rx...d.6...H....^....n..$*=..f~..(].s.....h.[......J...#...Ro...t..-@....D..c.N+3.....L..@.b..R.aP..b}..]C.yZ..6C".......]3...)YJM..L.q.|..ydc.'.....f.o+1F2...m\hS@.r.j...`n.Ou.V.. d.o.x.vfLht....5H....;6..1.7.xy0.;>...B._VB...K.}W[..*=.d.Z.......W..&...p.+...'.7. ...9S+5.G.....j....T..o....@.CY.-...".....~u...7........^....Ig.......u.....SF[....B..p=w...1]..\7c.......j..>....(.TL........A{...f.;...a..D9..i}.. ..&.1.iCS=Z...+9...X....c4L.....0....0.y.F........&..rN..Q4...F*...)Sl..N.d...!@........p.....F..X..S.x....s..}...$..`

                                                                                                                                                                                      Chrome Cache Entry: 531

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):334
                                                                                                                                                                                      Entropy (8bit):5.230800890568558
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:kRZzRxVvnGlUu6hAJAjWG/QV7lK0RDc+wQRaNw6JpyxZRNlad0:kRZTFGlqf1/A7fRorkbRN20
                                                                                                                                                                                      MD5:667A774BCF9CB2B1D598CCACE1FBB0C2
                                                                                                                                                                                      SHA1:8D11A24BF4C8CE5905FD60A4F71F952B7E24E367
                                                                                                                                                                                      SHA-256:97777544811E7AC700281C26F2B3A613EA082C60466909942C56B203142D8AEB
                                                                                                                                                                                      SHA-512:4B0100F9797AB3A3D3E29B59FAB1B34148735E0A99C09E62B7C286146BA6D0C5B52AFEE37284885FDCC85A3607E0FB68444E59B9D86BD1341177E69979323973
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("C7s1K");._.pr(_.uEa,class extends _.qr{constructor(a){super(a.ua)}H(){return"C7s1K"}O(){return!0}Ya(){return _.g4}});_.Zq.C7s1K=_.bD;._.w();.}catch(e){_._DumpException(e)}.}).call(this,this.default_PlayStoreUi);.// Google Inc..

                                                                                                                                                                                      Chrome Cache Entry: 532

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1881)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):42035
                                                                                                                                                                                      Entropy (8bit):5.438105518351378
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:OcZuiIuHit/b23CpoFSHMgDKanWoquo+VJK+a0Mf9m2WjiKey0ovZ5G/9MDiuyGQ:5mtVDMgD3tK7byU4i57oKtxMpSP6zsQq
                                                                                                                                                                                      MD5:9C5A71BFFED7A1969AA1639DBF474BF8
                                                                                                                                                                                      SHA1:B1C756E28E57318DC0FC10CD50E0D9963FC29CAE
                                                                                                                                                                                      SHA-256:B5ACD8EBB4FA73A98F4BF218F458B9E948DD48056622CE18ADFD509578D905D6
                                                                                                                                                                                      SHA-512:5770882D86261DA44686759F5B7231F663743F5C54DD16C8B5AE4C046BBCEE477C22BC89FDCDFD78D6328DE1FECC8F59BA25391B3EE3A238516386CE0ECC29DB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=_b,_tp/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.Gqa=function(a){let b=0;for(const c in a)b++;return b};_.Hqa=function(a,b){for(const c in a)if(a[c]==b)return!0;return!1};_.Iqa=function(a){return a.Lh&&typeof a.Lh=="function"?a.Lh():_.da(a)||typeof a==="string"?a.length:_.Gqa(a)};._.Rn=function(a){if(a.Di&&typeof a.Di=="function")return a.Di();if(typeof Map!=="undefined"&&a instanceof Map||typeof Set!=="undefined"&&a instanceof Set)return Array.from(a.values());if(typeof a==="string")return a.split("");if(_.da(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.Va(a)};._.Jqa=function(a){if(a.un&&typeof a.un=="function")return a.un();if(!a.Di||typeof a.Di!="function"){if(typeof Map!=="undefined"&&a instanceof Map)return Array.from(a.keys());if(!(typeof Set!=="undefined"&&a instanceof Set)){if(_.da(a)||typeof a==="string"){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.Wa(a)}}};.var Kqa,Lqa,Mqa

                                                                                                                                                                                      Chrome Cache Entry: 533

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7094
                                                                                                                                                                                      Entropy (8bit):7.959419718247538
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:F3JYFJ9r/nyXq20/1FmCXl4CbMM1kJ2ednlhhuFM:sB+q20/FXl4LM1kjDOM
                                                                                                                                                                                      MD5:28C793A8D42E2BF761FF6BE55C664010
                                                                                                                                                                                      SHA1:70D072E2744B5A30A99FE99AD0AB4ABA2CCDC124
                                                                                                                                                                                      SHA-256:633014DDBE1C4043A35FA963EC4EF649032F924B61BC717DE33C233C19534DF9
                                                                                                                                                                                      SHA-512:32C7123534B0F5F27ACF79A4C16A0A8617DE9AA790B90ED770167A2724A28024855792D949E5D90FEDCDD460DC6DBAADE1C9C4685EE7DDF41F60C64E23301CF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../?...M(l..Avw.......}.w...)..E..... Y8.$I.......g.c.l#.n.x""E*.*....nXG.m..g.W!...x....._.>uZ.......-j..1.....o.A.(h..q......3.........;j...v{.9.."..xL7.....o.v.U...G...IK .80M.5.L..`..i..e.....@fwP..QK..z.=.......d;.M...T......h.h.h.(23$gF......... y..m...~...R..m%.......!+.##.Q;j.....7.l..as^.......4C.9..N.......kx..9..U.I.....m.e..gx............L.g.|.m.m.^.l.m....5......Q..6C.m..#"U.}..y.m.Z.m.m.6N..>.8.....[..$.y..DU6...m..mv..m.k......../.....|....... .@.h.py..........|....a.G{..h.e..B@}d.I....G'...K3.....l.".bi{?.0....h.H..!....$..T.B..{:..Q..x.........&..P....V...|.H(BZ!.....?EQ0 .....c9....> .Q..@.....%5...!.j..YB..-p..$..>.KE.f..Xk"IU0....P....KG......7.W.4T.......9..s.@.=.j.!.......(.....>.....=m>...V5...V..[@.z. D...b....Y.....t...m....3W......b)C'2.......i..e..~....J2.0*..F.....>.....i./.}....U...O*.S.gs.<..+O..k/....x...~..]..-].......~.qx.KT*.].I.@....<\.&....sK7.".D...h/....h-..om

                                                                                                                                                                                      Chrome Cache Entry: 534

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (12046)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):315768
                                                                                                                                                                                      Entropy (8bit):5.54895275149453
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:IT0dmGFpmFuMlq0kd7+hJsEsEemve4s+2L:28MQ/h4JsOQ
                                                                                                                                                                                      MD5:F26C203C8E39CCD5191706781334721B
                                                                                                                                                                                      SHA1:CD2BB33539713DB0724CE3305C316421CA1F6212
                                                                                                                                                                                      SHA-256:187DBA39A07600C96F8071966173E0BBD0AFAC75446411B331B9EBF0079D7492
                                                                                                                                                                                      SHA-512:3B15B82F6CD0DCA8591C56DDFF6C8BB2B998317A0E5B7075905D64F3CBA1BD058A43886EF9F5FA08B11813C116130DC3ADFA9B839FD86750E07398EDC4F58484
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.googletagmanager.com/gtm.js?id=GTM-K59689F
                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"18",. . "macros":[{"function":"__e"},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__j","vtp_name":"navigator.userAgent"},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":true,"vtp_defaultValue":["macro",3],"vtp_name":"originalLocation"},{"function":"__u","convert_case_to":1,"vtp_component":"QUERY","vtp_queryKey":"utm_source","vtp_customUrlSource":["macro",4],"vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__c","vtp_value":["template",["macro",2],":",["macro",5]]},{"function":"__dbg"},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__c","vtp_value":"G-LL

                                                                                                                                                                                      Chrome Cache Entry: 536

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3817)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122923
                                                                                                                                                                                      Entropy (8bit):5.472299399758699
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:KAIcfKjLatJdHL6knxNEWKeNhSMu64zsibf/GZA50frNNyhAnY/iBl6Jap+a3U2Q:PIyKoncFMqH/GZv2ap+atK8C
                                                                                                                                                                                      MD5:675F3BFBA67EAF37FF1A747084B9D35D
                                                                                                                                                                                      SHA1:017F8D67C92C67E480A004535800A41D2F1FE78F
                                                                                                                                                                                      SHA-256:E643FAD6C7DA22675E44A57B206C5D7CC0E2528CEFAE6CB8858D128DCD98A5D8
                                                                                                                                                                                      SHA-512:9C982BF214F0D338A2DD413EE35D8C2A2E8B7468BDB064F869E98415F4546EAB5CA7A50072BDB55FDA51C0D8A7132BD6046C21EE8D5165305C1BAD608C6D6E2D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},t=ca(this),v=function(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.v("Symbol",function(a){if(a)return a;var b=function(g,f){this.$jscomp$symbol$id_=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.$jscomp$symbol$id_};var c="jscomp_symbol_"+(Math.random

                                                                                                                                                                                      Chrome Cache Entry: 537

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2144
                                                                                                                                                                                      Entropy (8bit):5.26370623880831
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:kSTRM3pR4ARI5PARBBRRgwRNG4pRk6RBbRjRRlO0RJc/dRpPMRVkrl:k+Mv4iI5KB3R/NGqkgB1jHlVJc/jpmVm
                                                                                                                                                                                      MD5:56A09334C967D2F034070EC04E58F5DC
                                                                                                                                                                                      SHA1:DB800A7FCA2C85B5607FD787232A5430A38AEA2F
                                                                                                                                                                                      SHA-256:CF6288044358D28983C58304B724156ECD5500700F85289178A87E0D1B598B2D
                                                                                                                                                                                      SHA-512:CFA53C3E7CBF64A237DAD39C53464248DD3950235D2C91E86C01A364B3B9AB9E234719A1314191144033C0B30CBE44FE3693E892892BD3C46687EFC3E83A1CAC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,C7s1K,CKm2Wb,CvxVpd,DRmmld,EEDORb,EFQ78c,ElYdAc,FCpbqb,FoxcOd,FuzVxc,GjTCAc,GkRiKb,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,M2Qezd,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,WhJNk,Wt6vjf,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fPcQoe,fdeHmf,fl2Zj,g6aYuf,gKWqec,grWkAb,gychg,hKSk3e,hc6Ubd,hhhU8,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,jZ2Ncd,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lDZ2Fb,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=CR2XMb,nQqY4c,baVq7b,zbKb5e,JiSSTb,Grlxwe,wxpxie,XMEW5d,QxNhAd,o6xa3b,G2gJT,q8s33d,Qf3l6c"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("CR2XMb");._.pr(_.eEa,class extends _.qr{constructor(a){super(a.ua)}H(){return"CR2XMb"}O(){return!0}Ya(){return _.B3}});_.Zq.CR2XMb=_.rC;._.w();._.u("nQqY4c");._.pr(_.jEa,class extends _.qr{constructor(a){super(a.ua)}H(){return"nQqY4c"}O(){return!0}Ya(){return _.Njc}});_.Zq.nQqY4c=_.eTa;.._.w();._.u("baVq7b");._.pr(_.UBa,class extends _.qr{constructor(a){super(a.ua)}H(){return"baVq7b"}O(){return!0}Ya(){return _.JVc}});_.Zq.baVq7b=_.KSa;.._.w();._.u("zbKb5e");._.pr(_.ODa,class extends _.qr{constructor(a){super(a.ua)}H(){return"zbKb5e"}O(){return!0}Ya(){return _.ZJb}});_.Zq.zbKb5e=_.XSa;._.w();._.u("JiSSTb");._.pr(_.lAa,class extends _.qr{constructor(a){super(a.ua)}H(){return"JiSSTb"}O(){return!0}Ya(){return _.WBc}});_.Zq.JiSSTb=_.hQa;._.w();._.u("Grlxwe");._.pr(_.xAa,class extends _.qr{constructor(a){super(a.ua)}H(){return"Grlxwe"}O(){return!0}Ya(){return _.QDc}});_.Zq.Grlxwe=_.rQa;

                                                                                                                                                                                      Chrome Cache Entry: 538

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):38212
                                                                                                                                                                                      Entropy (8bit):7.993997570128572
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:QB80RJjSBRg8+aPUNJroK5d+rF8hooqnGdAjkyJb01PFj1s:QB8wqGPpPrpo8hooqGcJbWY
                                                                                                                                                                                      MD5:83AC4CAE8240E1782435213A15B04A1C
                                                                                                                                                                                      SHA1:0A3499F2FC4D410A0B945F77380A76078511D4EE
                                                                                                                                                                                      SHA-256:986500DA5D603A6BAA9E89BE92EBB023231B9B2CDB305D567F715FF1A26FD94B
                                                                                                                                                                                      SHA-512:CF22A837F51964B35F07121E92AA8A5540B67B0F880C7A4EBC1F571F01EDAC950E8D59FB0AB02A0396183753372A4C352589776BB1F3848B3889DA9050419A28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF<...WEBPVP8 0........*..(.>e(.E."....<.p..fm..+..?.VW....w.~..I./Z..............._..w.......V..........?.O...O...............w._eO.?......L.}.#...s......_k......=...t;.......?....]..k..z....'.............O.~z.......o......P..^.........]....../...........O......;.........../....~.}D.........ot.Y...U...........?...~....}.y....K....'.f..~.|.Q...8...rM..Nz..e...e#JJ...i..Eu.`.v..1.....P-..1>5.|...+...$.<W..F.`.'..T......%.....9...)Ry.c<DlD..3.....~.j.....~.z.l......`.Y......ii.Ot...........v..G....."W.p...........r...jA..........8...G......<..O.#7....G..w.....G.=..".+....r.C..5..+.......E.U0.......6{#+.....M..3^k.w.;|.z.....c.<..z.y.........=......O.;/...".\3 ..A..F9.M.c..(3..#.U..5.....i...].3W,..p.xx....>6.[.....q..:)T.f%x.^....V..^mm .}.V)..l.kb.]...@"...'....D.5....o....B.Y.......uu...A/..9:({.(.c.,..C..,.G!.$~=...m\.k...h.O........*.Y...6Zo".^..Sz;.D..r.....z....3M...&.N&8......#{...u.rs..^......()V.G.........0..C.n..e.....'u

                                                                                                                                                                                      Chrome Cache Entry: 539

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 648x364, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):47368
                                                                                                                                                                                      Entropy (8bit):7.9963799118254375
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:LXMoFl7JOLBylFJCoSTYcPLmbUXlJPJ5eqDLyrfj38YHaiU/9rVMtDYFgAIp:rtlNIBWFJCqcPybUvJ5eqDLyrf77U/9w
                                                                                                                                                                                      MD5:C9474640ACA7313DE89B22F356287C6C
                                                                                                                                                                                      SHA1:42F3A2143411D230EE7004872A894005E82CC1C9
                                                                                                                                                                                      SHA-256:F99C0A263BE0A245F5DDC6D479348C049A431B1FF1E19A2A320F9A5DF10021AB
                                                                                                                                                                                      SHA-512:10A716D5CD8191562419AA41C50602F191C43FDF6FEC71144FFC71B928A483CE5582E99C0F66B564BBD3C576DABAC64003ADDB0A1751846814A0D558CBFB4D8F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/NdymJdpK2-wlwZ5Geow8DZubcJ6tUc-aYUWpkakKebcsZzh1r2OIUz3oy_rCC7_rnmY=w648-h364-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*..l.>](.E..!%.......b...W.....e}b....../t...g..i=.....H...9.k...G..Z...{........{..../._...w/.>...z..P.Y........c..S..'./..../.......?........S.'._=.K.....S2}..S..._..-.;._......#.....\+wG......_........?.....?.~....O.-.......?...z?.....3.7.oM....>...............{../Z..#T ...]...k$.....$..3%..l..$....If..(.\.R..Y%Y...I...^.4.j.S..$G.a.....I8U.....H. 5<...oN...z...l...\/......"...1..Q.q....?...K.#NA...9.........-....&Q.G}.....45.7....8U.%..D.a...@..;......#x.|.)../..a.($.......zq....1>.......S....J.t..v.>(..m..z&.2...?...z3tQ......K...w.........../.V....../..I.B+..N^.X{.......B.9<R.x. _...xCl....#.....r.%.~"P..?.5j..RE.Qs...g=...;A...E`.L.~".../..g+.D.q...z.@...o..u<...... w..."....\.}1L.....I..GCZ+.T..X.`].....W.|:.tU.;..e;...m6..".S..sQ....n.H.]..n.a.~......._;......L.{t.d....*....l....J......N...f.q3}......V.X3..../.,...~..M9..E..:.....Du....o....>)....j.......b...?I...=.Oo..v...L)u...0-.I.J..Xv....d

                                                                                                                                                                                      Chrome Cache Entry: 541

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):4.639719888612948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:EdAdhzUooooRoooT0oooooHooooooovqxoooooooooA:EkLL
                                                                                                                                                                                      MD5:A217F758EFDFFF14053678DBE58FA4D0
                                                                                                                                                                                      SHA1:6E0EB512C2F386D645712D7ECBE339EA85CFCA68
                                                                                                                                                                                      SHA-256:F343B3015D0545A7D5B719A434135BCAE2AC766ED459AEEA671E3688B79D1875
                                                                                                                                                                                      SHA-512:9BCF90FED875FFAF3170EF3425949642EB23B4E750CD42BA546D30E1A58C4FEE1A14CCDBD31455A6A442D09372CCB3873BD7477A59853608BC87660FB578119F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.gstatic.com/android/market_images/web/favicon_v3.ico
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................................................................................................................................................5C..5C..5C.]5C.5C.5C.`5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..=/..$l.................................................. <../A.8D..5C..5C..5C..5C..5C.:5C..5C..5C..5C..5C..5C..5C..5C..5C..5C..=/..$l..................................................TN.(?..'>..8D..5C..5C..5C..5C..5C.5C..5C..5C..5C..5C..5C..5C..5C..5C..=/..$l....................................................2..l...8..&>..8D..5C..5C..5C..5C..5C..5C.5C..5C..5C..5C..5C..5C..5C..=/..$l..................................................../... ..m...8..&>..8D..5C..5C..5C..5C..5C..5C..5C.g5C..5C..5C..5C..5C..=/..$l...................................................E...>......m...8..%>..8D..5C..5C..5C..5C..5C..5C..5C..5C.?5C..5C..5C..=/..$l...................................................B..C...>......m...8..$=..8D..5C

                                                                                                                                                                                      Chrome Cache Entry: 542

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):148
                                                                                                                                                                                      Entropy (8bit):6.523312318185472
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:clyg1ZreK5l1GzQ9O9xbSj0hGqBBs+dK484MVYQkGAKAJlJwBNlWn:coWZaKBUdSghtBfI43M0VJlJkWn
                                                                                                                                                                                      MD5:F6FCD4D43487A3BF8F47A592569FAFEB
                                                                                                                                                                                      SHA1:22B1887F1C703EA9ED827A59B02AC7FCDF79CA54
                                                                                                                                                                                      SHA-256:C6AEC5614A1193CCECA829712C4027C6F1B94A106395D2223229861AE110A9A4
                                                                                                                                                                                      SHA-512:98ECA13BC52869440EE4319FD09AB3C076EFBD51F769052B8C85571236355E50D5426F15CFD67F4DC1942D07D72A0BF0706ACADBDFC5CD2082645CF746778443
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/mw_NfsvKM8m6RPv8Fz2GQawCOsqWv010saMnc7zbWalMxuaA9IY8h7E0VMieLxSxAFB98NFeYqbFrXXq=w48-h16-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../......j.....]@G....51..C..G.3..<...w..#.O....{.P...I).......T./]......}..1^..|.~.}.B..B%.JP..%.\..%..$..K.Y,".\../?#..

                                                                                                                                                                                      Chrome Cache Entry: 543

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3371
                                                                                                                                                                                      Entropy (8bit):7.861369895028707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:0VhmKeLQLVeHFE7Vg+hhK1sB11hCYwuHxawn:0VsKeLQLIExg+hhpmYwGP
                                                                                                                                                                                      MD5:F26F7F4A5C1A4B1797459C31C58C17C5
                                                                                                                                                                                      SHA1:66A4995FE9AF59093F3596BDCAB2A280654B5069
                                                                                                                                                                                      SHA-256:ABC5646039F6994940432D272D7DE77BFEE7A46C335C32BF55A6867A2D9DA8B4
                                                                                                                                                                                      SHA-512:99A5F12D95D214A850DB877A7C83C83917FAD64C423E9ECEFCD9799BBF2D231DC8839469C35C86B0F19645DE78F75E6EAFD86452BD570A93FF2BB116FF5CDFC5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......IDAThC.Yi.T..>.^.{.M.":J.....h$..J%..IL...K...^.RH...H..&....r....%..S$d\c..E.A`z.....{.....T3.!.......-g..w.s..'..O........H............j....ZW+.J....<q...H.....&"!.23.........R....`.R.`.9...%.v"............._....Ri{KKK.......|>.aY.7a...+..D.@'v....r.\:..M...h..}FD\.T....L"......U.A.=.y.....O;....mg.v.....=.R3...........D...19..g2......T./"...#"dc..C.. ....af^.d.M.]w...."."0&...<.q...X..h?..(...$...|..J...y.&......BD.Z#f.`..m.....e...j.zM2.\....R'1..D4....D.-f..8..1;...r...R.0...h/.q..c..h.Rj...e.y....B.J.R!fF-......3.ND.q..yAoo.+.t......XDPGx...,..b.h. ..+..AA......@...%.W..D"...H..Y .j..d2..m..3.B..@D.t..B.....\..2T3^)..\./O.R....hX..6.r.. ........_""`..J.G........../.7....h$.H...BZ)u..\f0?*..!.@.z........l.|ADV.....n.. ..d\DY).b....=.T*......@.9...5.....:...p].Tf.ZD..g.D..3/...}u...56..p>.Ok.'...#..KD.)".4.._).......t..C..P.......Y.........f"B..A../0..7n|...t.D>.?..-"_g.V"r.L=.....ND+.R.m....a.:.Q..".

                                                                                                                                                                                      Chrome Cache Entry: 544

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2658
                                                                                                                                                                                      Entropy (8bit):7.894790694325241
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Xp4zSbrw5GYTT7TkhBtzfdxUQr9Yssm14efaCuIUeB9fGhDurKp3CF7p/+RZsux6:rbrw5JXs7tzfnUQym14dCtWhDI23OzA6
                                                                                                                                                                                      MD5:D547E08C578CF8D677CEFDEFC9FFC816
                                                                                                                                                                                      SHA1:0E000BDD5DBCC2593B480F69FCF2D82AF1B3BE9B
                                                                                                                                                                                      SHA-256:D155ECD552AEB2C7BCAA90227BC894992518946248DFBB57FEE4804BBF2A8C13
                                                                                                                                                                                      SHA-512:65F99E17EE3872C85BA5B80492B4805BA060FD4B54DF6071D2255E4DDCF9C894F474475DC3369A53C31A0A28B5F576305DD82A64CE811622CEC06E9F40D22FB7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/device-1.webp
                                                                                                                                                                                      Preview:RIFFZ...WEBPVP8X..............ALPH.......m..w.....m{...].m_3.m..kt]=....m.J.A.d.RW.r....`},..e. ......)Y.%.H..i.."..%.K.r.>7:..K.?~.V.t..r.K.ei.{.M...'......./.HW...].U.>.K,.....J..q.5......JI.....[..A.`.....5.9g...R...Z2.... ..hW.)i.t.$m.B,.F.Y<..Ri.NS..X8......]s...........?......Wlm,....5...`~{.....-....;i\q..s.....j.,..}.4)1Z....P....6...>.....H..s..2...C/..-7...{^{.Y..@...+>y.s..D................s...Z....d..d.~{........g]t..H3(Jk...F.jO.K5...O...UT......-U...G..E.m.S%.u.}./*g>....5.&.X.j.f.H..g.:3..7<k.iMq.4B......NQ....U...)... ...-..jr....VSi6F.K....A.hCS.hLp...V.jL...!...B.t..4..0.4M.(....+T.R..d._.9.hQ...F..VPT&.b8.....g?b'T&...v[....................$;*.tl.i..;..(...ES{....D.Et......J.,.{.(...HI..y.K....no.{o.y.j.HvQ...P.........~...*....k}.._...."....eJo..W......;M...}..JgD*..M..+..jj^..|.....UIgC..=L..^.o.9...O.%.~...| ..$?.U....)....s...5'..GO....ff..p...W.=...y1......*..W........`..............+iDHe^..R4.o......-....DH.@

                                                                                                                                                                                      Chrome Cache Entry: 545

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1881)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42035
                                                                                                                                                                                      Entropy (8bit):5.438105518351378
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:OcZuiIuHit/b23CpoFSHMgDKanWoquo+VJK+a0Mf9m2WjiKey0ovZ5G/9MDiuyGQ:5mtVDMgD3tK7byU4i57oKtxMpSP6zsQq
                                                                                                                                                                                      MD5:9C5A71BFFED7A1969AA1639DBF474BF8
                                                                                                                                                                                      SHA1:B1C756E28E57318DC0FC10CD50E0D9963FC29CAE
                                                                                                                                                                                      SHA-256:B5ACD8EBB4FA73A98F4BF218F458B9E948DD48056622CE18ADFD509578D905D6
                                                                                                                                                                                      SHA-512:5770882D86261DA44686759F5B7231F663743F5C54DD16C8B5AE4C046BBCEE477C22BC89FDCDFD78D6328DE1FECC8F59BA25391B3EE3A238516386CE0ECC29DB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.Gqa=function(a){let b=0;for(const c in a)b++;return b};_.Hqa=function(a,b){for(const c in a)if(a[c]==b)return!0;return!1};_.Iqa=function(a){return a.Lh&&typeof a.Lh=="function"?a.Lh():_.da(a)||typeof a==="string"?a.length:_.Gqa(a)};._.Rn=function(a){if(a.Di&&typeof a.Di=="function")return a.Di();if(typeof Map!=="undefined"&&a instanceof Map||typeof Set!=="undefined"&&a instanceof Set)return Array.from(a.values());if(typeof a==="string")return a.split("");if(_.da(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.Va(a)};._.Jqa=function(a){if(a.un&&typeof a.un=="function")return a.un();if(!a.Di||typeof a.Di!="function"){if(typeof Map!=="undefined"&&a instanceof Map)return Array.from(a.keys());if(!(typeof Set!=="undefined"&&a instanceof Set)){if(_.da(a)||typeof a==="string"){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.Wa(a)}}};.var Kqa,Lqa,Mqa

                                                                                                                                                                                      Chrome Cache Entry: 546

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):792
                                                                                                                                                                                      Entropy (8bit):5.22005073702102
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:kzeTy1wRTDN1BR91PRN1jRJPAeC1LRL9rl:keTRRTDtR91JnRJ4eGRL9rl
                                                                                                                                                                                      MD5:EE42271B60C4764E551484A2E4D47BCB
                                                                                                                                                                                      SHA1:2BBDE92E44A7EB58747F2E53D9F7F71983593F89
                                                                                                                                                                                      SHA-256:A289D1011B279F779BB42B31CADCE830EB17C1FFF4B895552A5CEE589E3359DC
                                                                                                                                                                                      SHA-512:F21EB59C68E77C0DE68C309C0FD1076B54C46AB39DE4EFD12FFC588FA173019C9871BE8008DD621E5BDBA03DA721DB49A780D5E76433247666EFD888779F976D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,CKm2Wb,DRmmld,EEDORb,EFQ78c,ElYdAc,FoxcOd,GjTCAc,GkRiKb,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,g6aYuf,grWkAb,gychg,hKSk3e,hc6Ubd,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,qczJ2b,qfGEyb,qk5AGd,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=yNB6me,qqarmf,FuzVxc,I8lFqf"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("yNB6me");._.pr(_.MCa,class extends _.qr{constructor(a){super(a.ua)}H(){return"yNB6me"}O(){return!0}Ya(){return _.Ybc}});_.Zq.yNB6me=_.ccc;._.w();._.u("qqarmf");._.pr(_.xDa,class extends _.qr{constructor(a){super(a.ua)}H(){return"qqarmf"}O(){return!0}Ya(){return _.Adc}});_.Zq.qqarmf=_.Efc;._.w();._.u("FuzVxc");._.pr(_.zDa,class extends _.qr{constructor(a){super(a.ua)}H(){return"FuzVxc"}O(){return!0}Ya(){return _.$fc}});_.Zq.FuzVxc=_.cgc;._.w();._.u("I8lFqf");._.pr(_.CDa,class extends _.qr{constructor(a){super(a.ua)}H(){return"I8lFqf"}O(){return!0}Ya(){return _.fgc}});_.Zq.I8lFqf=_.hgc;._.w();.}catch(e){_._DumpException(e)}.}).call(this,this.default_PlayStoreUi);.// Google Inc..

                                                                                                                                                                                      Chrome Cache Entry: 547

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):4137
                                                                                                                                                                                      Entropy (8bit):4.903490054697936
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:XloY/8YH+bKqrQEyqpjKkcvteR2KbcbKqXG0dRVwf:XL8YHoKqrQETjKnvte4KbqKqRds
                                                                                                                                                                                      MD5:A78E12D3A036307B9EF08FC063278E02
                                                                                                                                                                                      SHA1:A31FA495095783EF5A84BA4DBA0BD6F7DE3B07EA
                                                                                                                                                                                      SHA-256:4812D4E2FBFA080EA51EC6755F24DD8728C9C428CF89FFD34648E7B321801A71
                                                                                                                                                                                      SHA-512:FE57F6CB677B48525ABBE1B84C681709624E014C720E6243F936F7E4276AA0C64043C78D5F4B200CA21295CC42B46A4402EC9BD50E6F18F7C1D5731EB6D7F414
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/photoswipe/photoswipe.css
                                                                                                                                                                                      Preview:/*! PhotoSwipe main CSS by Dmitry Semenov | photoswipe.com | MIT license */./*..Styles for basic PhotoSwipe functionality (sliding area, open/close transitions).*/./* pswp = photoswipe */..pswp {. display: none;. position: absolute;. width: 100%;. height: 100%;. left: 0;. top: 0;. overflow: hidden;. -ms-touch-action: none;. touch-action: none;. z-index: 1500;. -webkit-text-size-adjust: 100%;. /* create separate layer, to avoid paint on window.onscroll in webkit/blink */. -webkit-backface-visibility: hidden;. outline: none; }. .pswp * {. -webkit-box-sizing: border-box;. box-sizing: border-box; }. .pswp img {. max-width: none; }../* style is added when JS option showHideOpacity is set to true */..pswp--animate_opacity {. /* 0.001, because opacity:0 doesn't trigger Paint action, which causes lag at start of transition */. opacity: 0.001;. will-change: opacity;. /* for open/close transition */. -webkit-transition: opacity 333ms cubic-bezier(0.4, 0, 0.2

                                                                                                                                                                                      Chrome Cache Entry: 548

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                      Entropy (8bit):6.676048050841229
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:0Zrwlp8NJrXNwje/UwbgXwYIlGKZqvqJAy7ZrUilBCkzX/BfTA1D31n:0ZklpUXNwjecwb7lGurFUihBLiDF
                                                                                                                                                                                      MD5:461204FBB9CB6D19F763B8EAECDC01D6
                                                                                                                                                                                      SHA1:95354D81968469C5A9EE2DDEF3C84B9F788802D0
                                                                                                                                                                                      SHA-256:FD29716389D0077F1D88C7ACA6A408FDB9E27A9D33FBD74B265CFF2F6A2E3786
                                                                                                                                                                                      SHA-512:B7BA5AB186109447B9C6317F7E9EC8BCBAEF65B1A0EC96FB12334A3C0DF97430B142B2C3C7011C0B7D09C425C8E673CEA79F4EF126FB01BB0D8E23409A177BEE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../........G...C-....13+N.8....3.q.G..M..G....~.4.2IP_..)......Z:.}.....$...... O.....,......QU....T...$.?%.....z);I2Z9...=$...{./u..2p.cj.\...%m..

                                                                                                                                                                                      Chrome Cache Entry: 549

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (706)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3405
                                                                                                                                                                                      Entropy (8bit):5.56027315793963
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:kw2mk47cpeTiUA2JlkubkAtj/nkgBgaNfNl:cmkccpEFJHlgcH
                                                                                                                                                                                      MD5:0EC4E905D0D70F6E86F8AD73DD13828A
                                                                                                                                                                                      SHA1:E31882864E7E6FE8AF8E61002E40E1865893413B
                                                                                                                                                                                      SHA-256:A57115DA8DFE7EA6307D78BE177069B1019C556504B6599232D26BFBBFDD1B6C
                                                                                                                                                                                      SHA-512:C3C67E48032C86F1FFAEB31CA350E3DD227651A51446E9598A2E3C660A5E6220F39BA74E23B832B7D006043B7D104BF3F4F49A2CC89AF1F289FCD8E8B7311458
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("Wt6vjf");.var tdb=class extends _.z{constructor(a){super(a,0,tdb.le)}tc(){return _.dh(this,1)}nf(a){return _.zh(this,1,a)}};tdb.le="f.bo";var udb=function(a){a.jI&&(window.clearTimeout(a.jI),a.jI=0)},vdb=function(a){const b=_.YK.get(window.location.protocol=="https:"?"SAPISID":"APISID","");a.JG=a.ME!==""&&b==="";a.DO=a.ME!=b;a.ME=b},xdb=function(a){a.aA=!0;const b=wdb(a);let c="rt=r&f_uid="+encodeURIComponent(String(a.bJ));_.Ek(b,(0,_.Ze)(a.O,a),"POST",c)},QL=function(a){if(a.wM||a.aA)udb(a),a.jI=window.setTimeout((0,_.Ze)(a.H,a),Math.max(3,a.SE)*1E3)},wdb=function(a){const b=new _.Xn(a.HV);a.TJ!=null&&_.io(b,"authuser",a.TJ);return b},.ydb=function(a){a.JG||(a.aA=!0,a.SE=Math.min((a.SE||3)*2,60),QL(a))},zdb=class extends _.Vj{xd(){this.wM=!1;udb(this);super.xd()}H(){vdb(this);if(this.aA)return xdb(this),!1;if(!this.DO)return QL(this),!0;this.dispatchEvent("p");if(!this.bJ)return

                                                                                                                                                                                      Chrome Cache Entry: 550

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):12920
                                                                                                                                                                                      Entropy (8bit):7.977885299498505
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:BcqMdTJJGnG7bXB+MC2dvOkz5D0j7ZlbWVm6MYKJ/j6BQGjosoQ3a3hF+FJW9JoE:Kdb7rCsBFD0/bUfU6aGjfoPxF+zEUt0
                                                                                                                                                                                      MD5:2A2394A3DD133160376C9B4758B3FE68
                                                                                                                                                                                      SHA1:D8E040D53649C46B3939B07C5CAAF0C82268CCA9
                                                                                                                                                                                      SHA-256:86ECA579F61CDF7E3DF641A081FFF80D9D21F9D7ABEC40DE962653D19BEA6484
                                                                                                                                                                                      SHA-512:61FEBDE89F6BD3910B629DC2468157D1CEF24DFED9DF02F083C0276C5432B48E2361D634EBE7AD73DA62DECB2B7B1B76A5348466263A8CDE8383F157AECB8122
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/image_more_1.webp
                                                                                                                                                                                      Preview:RIFFp2..WEBPVP8X........)..W..ALPHg....w`6..R.(S.b.....<.5.....&kN.?k"!4....P.........".?....9.Z...v.bvI".........?..........h6....d.vI.;dS.VP8 .1..0....**.X.>)..B..!..5x........k].r.,...F.0.$....mxW......?7.....*..2..l........?s?......?..'......?G...R.....'......k.@.$.y..._.......?...~......3...w.W...O.......}........).......o...O..........}@;A.\...%.....S....E.i...Y.......p..........................?.~..v...i.Q...z.z......?........u.?....R...k.............?........?*.....y.+..........?....c...;..........5..._._...H}..0....................Y.c.....W.yL....(.2.60....w...%-.....Ss.....#*....e..<v......!....yc.........T......rm......Nkh..F.UI.A.......8zK........<."..3...Mi..}l.}1..w....Tb.y.p..~...%..c&5Zx.P.........Z..f....+...z@.a..F...EM$.{..3y..0I.....}~....t9...t})u..M.....h..(.2.68P.e.lp..wn......./.0}..J1A.{.e/...nA^.jQPy.b....8..I./...=q.X...s4.M.-N.....{....w.n..1?{.~4n......Z....4-tI...|.C.Q..73......f[W..4.y....G".@.P.V..OX.R..prH....

                                                                                                                                                                                      Chrome Cache Entry: 551

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61748
                                                                                                                                                                                      Entropy (8bit):7.989183763154298
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Vy35XrfooAdq5fzwLTM08K+H5rWlyRzcoMo:49fdX5fUU08KiY0dh
                                                                                                                                                                                      MD5:A538AA1A5C81C10119948446E522D703
                                                                                                                                                                                      SHA1:791658E4C5E7B65CE030F671D79E5DEF60FBC421
                                                                                                                                                                                      SHA-256:BA4CB75A6480511B005F33E6B0D8C6931DC3EE2001E4136F4A2F6AB4341A4720
                                                                                                                                                                                      SHA-512:EAB184503116A9B01BCA3D052A5FD60C94FCC985BD8AD34F8A4909B07A060D429CC607EAB72A22A0CDE74F745F44D436E5ADF91EE6D7A0B1A9D79C6AC7329628
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF,...WEBPVP8L .../..?.M@.$7l3.... .`IVJ.....?I)..?V.2.a?...}K.z........"."..D........to....iI....s.nE.....<>.......o...{....A..F.2.?......*.....%`<.......P.7....c.....|]...m....Z..o\...Yld|)rOU.g.......Y..2.....uy.4.o.x.q.E....D.A.0......nq#.....tC.H....\Oz..$O.q|.....F...`.TU..HA.....\.m...pe......h.mIU..+c..S93s.=#........L..-...,..M%f...$.JF....[@....8!A.....IVm[y....=.>........L..A.4.f..8k........t......z...f5.S....B.a$.......=m..j....%..^.....6R.e.W......,..YI.#&.......S...k~W.o.........v\..M.......w..........?.!.-.^e.j^].........G...=....?..#...1.7...R5.K..R.%l...........xx.>h. #`h.&UN...S.x..O{c- ...9...A.?..o._...T.d..UK.?..K...q......,..)..j.{..L}....?..3.G.....y.]..Pw..d.r.X.....)......p.|...&.D;...v(K..?.<6.mgZ3....5...<.........;..h...'.p...v...{.,5.-..v...<.......0.e.$..B..w.J.t...8.^S~..N.'.......=t8.o..c.y$....%...&..0,.....P.8..?k.f.......u.......s..........;..0%r....M'l...<....e.....a.....iXQ.J....J. }D......a.bEc}w...6

                                                                                                                                                                                      Chrome Cache Entry: 552

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (2283)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206821
                                                                                                                                                                                      Entropy (8bit):5.506034054993372
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:5oN0qTAiHf0BtVNZdicI+JtgOZOtuWk29itiQ/Zc0xhezogSI9vYrzQb4K3PHiz:5oN0qTAiHf0BtVNZdicI+JPZw3k29itF
                                                                                                                                                                                      MD5:B51F7E7F1E9F86A40B400FF9E9E59C34
                                                                                                                                                                                      SHA1:9D1D8022C0101B658D2366551E9E934FA73B77FC
                                                                                                                                                                                      SHA-256:C63F631D2FBAD3875B925B62DD7B14D7110E3AC2C876A3F63027918541B51E82
                                                                                                                                                                                      SHA-512:A345B84F6C3AD519A9C58604D77CE5ECA0476AC94BE760C6D2D8E7749F37A41D1519572EB271D04D89DA3B6E34C7B3CF7157ACCFD87609E6A4EE58BE974CEFE1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x19b747, 0x103eba3, 0x3f00c093, 0x18c1c783, 0x1, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.*/.var baa,daa,iaa,kaa,Ia,saa,xaa,zaa,db,gb,Baa,Caa,Daa,Eaa,lb,nb,Gaa,Iaa,Kaa,sb,Naa,Paa,Qaa,Taa,Waa,Yaa,Zaa,cba,fba,$aa,eba,dba,bba,aba,gba,lba,mba,Nb,qba,tba,vba,uba,wba,bc,ac,zba,ic,Dba,Eba,Gba,Fba,Iba,Jba,Kba,Mba,Lba,Pba,tc,Qba,Rba,Sba,uc,Uba,Vba,xc,Xba,Zba,$ba,Lc,bca,cca,Ic,gca,hca,Hc,Jc,kca,rca,wca,xca,yca,Zc,Bca,vca,hd,Tca,gda,xd,ida,yd,mda,oda,Cd,vda,yda,xda,zda,Ada,Bda,Cda,Dda,Fda,Gda,Kda,Mda,Rda,Sda,Zda,$da,aea,

                                                                                                                                                                                      Chrome Cache Entry: 553

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):42322
                                                                                                                                                                                      Entropy (8bit):7.99596563855182
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:eVTTtywwXjTdLjwT35hjsan6BzmcfM6DDyLRB3Qu8zgy1vXUGFcndCKLev4:eVHvwtLUhQa6Bz/MSDeRBQuigydpuB44
                                                                                                                                                                                      MD5:28072429C2565CD8226F3FE62774AA3A
                                                                                                                                                                                      SHA1:AC550713A85133748B331306EF7FF084826B4CBD
                                                                                                                                                                                      SHA-256:410CF2E9600AE8EC37701944F7ECCD2EA54E82D91FF19559F4E8823C1E344958
                                                                                                                                                                                      SHA-512:39B59CF822578E57AAA6F3888B425D385BDA24D8511A4CE89CA26274B497619880A1C2C8DBE6C21F2C531AC15A2A2B5D82C2938ED98BCDBEAEC1D07006A5DBFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/Nr-CQh-9CAqc8V_0V3M4yZEf1oeni968uzMww8lzHzG1RVRUXVR39YTJAK4RGFAry6s=w526-h296-rw
                                                                                                                                                                                      Preview:RIFFJ...WEBPVP8 >........*..(.>m*.E."..07.@..fm-*.q.[....?.b.......HnM...ZM.w........y....c..._.oa..?..S.......c............~.?.......Q.9.#....g..^.......?w=..........{....(._...o.|......._/.....g..........?..S...... .S...c.......^....S....../._..~..........=\.5.W...........~.>....k.O....._........W..........n...O..._._.......e.....'...../........#)'.u{u...4$.e0d...I4..);^...R..i.@..4...(...GH......N...k...=..w.]WJ./. ..|.G..0..f..........U....P6~.h=....#...|+...}...T.67.Vsn.F.....a...c.k.l.......t..:.(...zx...0.'..,-....;..V^..a".Q..."xZ..`.(6......V..s..........f.fe..djb..*..{#Im......x.)....V<!U~..YG...&c...G.W.g......z..C...x....T..i.......N..Mt...o.iL...;3J}H.n.WY9%.C....q..u....T..!....!...v.3.*._...4....s}.tV.7./...jx.S[..RLH..l..V.4>..../G....t...6.TO..F2..c....I.....Vo....._..k}....&.l..xs..@0..Jw...e.h....mN:.....T?..T...+...L'.>.4..=..kOc....9......H.8..."J?*E..@..5p..[.2oG....z.....F.i.o..........k.W.ub.......Z.7.>..5.e....A.*.*P\.

                                                                                                                                                                                      Chrome Cache Entry: 554

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):220792
                                                                                                                                                                                      Entropy (8bit):5.130794564563118
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:FWsqo6hBRv+vccsR5vaqTrv615yUHbEnAX7X:FNqTrv615L7EnAL
                                                                                                                                                                                      MD5:0C2CF5DCDE790CDB924721D71126250A
                                                                                                                                                                                      SHA1:B457D39AFF8F93E2B657C7FBEE21DA63BB113F63
                                                                                                                                                                                      SHA-256:92BAA160B72DDECF6B4B5F99D9042E7B6B91A6FA152E4B41B01C7D2EB2560DE4
                                                                                                                                                                                      SHA-512:5427A98152A419C18F6C151DCA616F0DF7F33A261A18768357599DFD04297A12081E15BF7EDA7D6F49D9E407B7C10DFAE0AE199A9A0B38BA7EFF9969596D9723
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/bootstrap/css/app_1.min.css
                                                                                                                                                                                      Preview:hr,img{border:0}body,figure{margin:0}.btn,.waves-effect{-webkit-user-select:none}.navbar-fixed-bottom .navbar-collapse,.navbar-fixed-top .navbar-collapse,.pre-scrollable{max-height:340px}.waves-effect,html{-webkit-tap-highlight-color:transparent}html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}b,optgroup,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0}mark{background:#ff0;color:#000}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{vertical-align:middle}svg:not(:root){overflow:hidden}hr{box-sizing:content-box;height:0}pre,textarea{overflow:auto}code,kbd,pre,samp{font-s

                                                                                                                                                                                      Chrome Cache Entry: 555

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):20150
                                                                                                                                                                                      Entropy (8bit):7.9615289884912
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:X6QOkn5awMPC+Kqm4Ie8R3xxsSZsXi3EolFUplVJgmh5KW:XhOkwWp4msXi3EmUphVh5KW
                                                                                                                                                                                      MD5:71B4A36AE4E97644E908AB316B53D437
                                                                                                                                                                                      SHA1:102DD29C1FCE0CB165C3EB93425E5EA4BE793274
                                                                                                                                                                                      SHA-256:6992E8AC80458599555714A05BF285401506E05E32C104E854ADE6D3B7A516A2
                                                                                                                                                                                      SHA-512:8AF9A5B3F88E9D60BCC5421D6289AEB4B36D748F74D39AFA20A0A4AC2BD81B72A767546CE23459C15DA61D54A4B9FC9D900C11750B31FADF5E1C257749236C3D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF.............................#*%#"""/-/)//'10--/-5=PB58K9--EaEKSV[\[2AemdXlPY[W.......0..0WB8?WWWWW]WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................@......................!..1A.Qa."q...R....2B....#b...3Sr.Cc.$...............................-......................!.1..AQ."2aqR......#.............?......!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@....!.@...G.x.z...s.6..8.V...~D..c...b.B.&C.U%.3.cS.L~..}.?......}.q......f...S.J..Z......JIf.{at#Bz}..{..].P=..{..].R.N/..HD....Wh..Z.d........a.'...j..y".b.&..v..u6...~J..#....)..'/#.t.!B}.K.....~.}..{....d..l#..$!Bz}..{..].W..rc=!.~.(..-&Z...N.U.sK..0n~......=O.S..F.&..;....&...p.~..(...].<.].9!J.1.*Lf.9.7.?...N.6.,.!.7......Xf.a.....@.5....~.}H|......W.g..a...P.*.......q.3............H....*...f.Njv.~.y..e....6

                                                                                                                                                                                      Chrome Cache Entry: 556

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):834
                                                                                                                                                                                      Entropy (8bit):7.744071106244072
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:n7S4DstdrO3r5z5Js8he9D7Tjcpve0It2RQJPTmy:nO4DsteVzs8Wvj1LNmy
                                                                                                                                                                                      MD5:104D12720A57EFFE71763FCAE58A8319
                                                                                                                                                                                      SHA1:A0000897B2C258619963424378FDD95B7BFB635C
                                                                                                                                                                                      SHA-256:F0892D6CBB859336F59AC8BC48EF20E6DEE49D72FCCE038D510CD875D6DBB41C
                                                                                                                                                                                      SHA-512:CEC9AE6259219DD0F0870281AF6A69664FEC640ED4650025D2061BBB575C30796A7EC36DDDAE5BA693B9D48F5FD222230889B0529F994483C8A6858B30AB652E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF:...WEBPVP8L-.../?.......$GRT...q.9.m.....$ERfu....&<N;l..$......._.p.P..@.@..e0...>...Z....q..J. PP .B@...a.BA.O..|G.o0(\ .8.......Ba....... .*..........1?....-.:........3#/...|.r..b..b1fi..cDm..^..Z7.K......G....hW5>...mw.....^...`I`Uj.A.5F.T...@<@tmo..H+.q5.........E}.kF,bM.+U!...2jB.T.8....RP{.........0..m..y...w..fd73._.[.m.f.m.......y...O...<.#l...rYI..R.......%....Z..r2....,p.$..2b.|:YN.z#.w+N......B...y..4.D..wv.|"QI.....w*.RN...y..%u.....2)Ea.l.....)ZB&....2.B.....%#...Am..gJ...t..r....P....l?.K......vs...H..NYm......c.t.t...azi...GW.u.....N....."..K.1.>H..0.?.~......?..\.e....^7....\........G..d%3~%.\&z.....3O.3=]......}.)>G..{.OH.....y..].. KUD(....t4.TUbLGc.;m....6^..b..X.......4z.....ocB...:.k.1*i....o`h...m.Fn>.-.K.A.X....M....r..Eu...nx..a.Z...r...j4..X.6tV.....9.....

                                                                                                                                                                                      Chrome Cache Entry: 557

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):835
                                                                                                                                                                                      Entropy (8bit):5.1223932389292655
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:D76bBSDFvVdGUF+fWlp9CkXXW/clctloFHMZeKsf:H8uNAwlpJmicnosk5
                                                                                                                                                                                      MD5:A88ECA42083170AF225E964720471609
                                                                                                                                                                                      SHA1:B73B59A702C62AD43B7617FDD627693C5240C659
                                                                                                                                                                                      SHA-256:88995CCAA41E5467D559C0BE6C5D61FC5A49DE7E194861AC9EED559A5B4FB6F7
                                                                                                                                                                                      SHA-512:21217F9BB3CA7F8D735448BFC4C3E3AA277B13B4BC1127AD5F406E84E00847F902533C45F145D1C050075EAF8FB249121C96A27CD9BF2BD18BE08286CF57D6AB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:{. "operatorDeferredUrl": "https://ssl.gstatic.com/support/realtime/operator/1726819261182/operatordeferred_bin_base.js",. "eagerLoadHostnamePattern": "((https://www\\.google\\.com/express)|(https://www\\.yt-web-green\\.corp\\.youtube\\.com)|(https://www\\.web-green-qa\\.youtube\\.com)|(((ads|adwords)(-.*)?|campaignmanager|photos-.*|play-.*|support|support-content-staging.sandbox|business|fi|.+\\.corp)\\.google\\.))",. "eagerLoadHostnameFlags": "i",. "cbfVersion": 1726819261182,. "screenShareVersion": 1727168469248,. "settings": {. "enable_customer_can_end_chat": true,. "enable_emojis": true,. "mole_show_survey_url_percentage": 100,. "mole_skin_version": 2,. "operatordeferred_report_rpc_events_percentage": 10,. "screenshare_skin_version": 3,. "rms_screen_share_skin_version": 4. }.}.

                                                                                                                                                                                      Chrome Cache Entry: 558

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):376
                                                                                                                                                                                      Entropy (8bit):6.890802046110792
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:DZwIU7ruqkhiyuZxYVoeRU+P9FRGJTIobilO+QxYO0ssdxI8jEmNl9Ttdk:UvlkQZOM+Pn+daIYh9O8jEmNTt2
                                                                                                                                                                                      MD5:3F8CBF6299FBFB7875D4412ACEDEAF4A
                                                                                                                                                                                      SHA1:2CEA74A116506B74B96A14AC118FB0AC8D553DAE
                                                                                                                                                                                      SHA-256:B5CDAD13A7242EB7EF09EE51E60C05F4AD0174F2214E824A1839B93983005A47
                                                                                                                                                                                      SHA-512:CE66B310F2694FD32D901BEC525924805CE744565CF4CB982CC1F7B556AFAAB5269429D1A09EBBB10766C1BF9AB655D67192098C795F6CB3E4A1DE662C0C28D2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/bOOrAMR_IOv0jyKJU2MstONEBGzAEQmEoNmaRPl-V4CY4uvFNmrI2aBoXmnhGxhsxdo=s64-rw
                                                                                                                                                                                      Preview:RIFFp...WEBPVP8X........?..?..VP8L(.../?.....m.=z...;Hi..m.s..S.m.m[......T.".?.|}..X.7-...+.T2s.......U....k).T..g....2.........@%3...x..B..B!w.....!.@....H.7.^...`F.8....@?e..p(....r...F......,..B...I...kB...!w.....2.K..`(.;@.dp<0-d.......2X.8...T.9..4..=...VQw....?..P.Q..c.........pk...._.../.?.3u.Y.6....j._..53W...K....EXIF"...II*.......1...............Picasa..

                                                                                                                                                                                      Chrome Cache Entry: 559

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (32025)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):84380
                                                                                                                                                                                      Entropy (8bit):5.366845733753481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:/P10iSi65U/dXXeyhzeBuG+HYE0mdkuJO1z6Oy4sh3J1A72BjmN7TwpDKba98HrZ:++414Jiz6fh6lTqya98HrZ
                                                                                                                                                                                      MD5:4A356126B9573EB7BD1E9A7494737410
                                                                                                                                                                                      SHA1:8258D046F17DD3C15A5D3984E1868B7B5D1DB329
                                                                                                                                                                                      SHA-256:22642F202577F0BA2F22CBE56B6CF291A09374487567CD3563E0D2A29F75C0C5
                                                                                                                                                                                      SHA-512:005C3102459DBF145DF6A858629D6A6DE4598FAFE24CD989D86170731B0C3B3C304DA470CF66BFD935F6DB911B723DF0857B5ED561906F7F1C5C4E63ED9430DE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/bootstrap/vendors/bower_components/jquery/dist/jquery.min.js
                                                                                                                                                                                      Preview:/*! jQuery v2.1.4 | (c) 2005, 2015 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,functi

                                                                                                                                                                                      Chrome Cache Entry: 560

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):645
                                                                                                                                                                                      Entropy (8bit):7.631563068517978
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7ihaL0Z6T2rkLv0cLSbLzKlRv+reS0TZPhnv8NuKS8jrRJI1b3g0hfue9:riS+v05bLzK7CmTRhnUTJjk1b3Jhfj
                                                                                                                                                                                      MD5:EA2722D3B676D5CDD4F7225E65695112
                                                                                                                                                                                      SHA1:97E5E94CFF5B62F60BA76C7DD9F606304AF8B10C
                                                                                                                                                                                      SHA-256:317E5FDAA14E548C0045D5E662709CFE0B692E0384A8396CF22054BF0A1E1C48
                                                                                                                                                                                      SHA-512:BF06CE48B306A0EA13EBC7BE92CB56440DDF1C35C214BA7C164DECFDA6E2E7AAAB31605196D0690BE4FF509404701CA620C504A5EDF0C3E6A12C6FA5A73C78DA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....szz....LIDATx.b .<|...P|.h(.E.0.....|.x.......a.....!.....q{.t.U...(.A.g.....w.3,&.s.~..h2.....Ip=..4!..[.................r.p6.R......R.....19]z.......%.E.q..........6".#...9..Y.n.U.ZU.ZMu:.Q:t%..y`<.+.0T6.=.i.0.e..a.f...b.\..Ax..e...K...$7..BAk@.\f..}bG.K....\Nk@.T.ha.+.w.%x.5.....k..OJr...$Gd....,.0....n.{..b........%].....K.....?....f....w....j4...@%p{?...|>.....hH.h.....r....h..s.J..@X.j..3#h>.`@Xw..l.K.;).c..>....V.b. T....0B.4....%G......a[..P.........G..B"..!*...m9rj%.....E.AD*...0...!..y``....o.z...1J.FF,..sEr3.s.&....b.m.+.........'.m3(D..{..:..So.Ja..*......#..'....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 561

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5898
                                                                                                                                                                                      Entropy (8bit):7.954651102582187
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:s3BY9a/eum1aA1nUaF8ux95cRA2IUUYQHqJwCJFXJ8Pw2WqGVBf68N1e2R3Za:sxYCs1aANUQ8uX5cRAUQMwiXJGw2Rl8y
                                                                                                                                                                                      MD5:3A2D978D845DF8BF55DC483C7ECF8388
                                                                                                                                                                                      SHA1:F97DA276B9697C91D5195AA5C8C50A6B62735519
                                                                                                                                                                                      SHA-256:C914C824D225BEDA3CA2182EA4C44C153752CB9BA6814C8E9F1499577ABDA8CE
                                                                                                                                                                                      SHA-512:0E37E2F254D3AF1794B6AE2986BBAC4CA82F20C5E6DCB4DA3595826ADDD549D5C286B26CE74CE68C9A7120D844DA6C85118288D5F408A25D8EAA5DAD4340B353
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........)..W..ALPHM....g.&.!.U.1........;S......e.U$cXD..c./9.F...*..?..?..?..?..?...w.E2{$wE......VP8 .....o...**.X.>)..B..!.J$(.....p..q...bo..5.D.....r.K....k.....7......$...........W...w......`..}..$.g...'.7....~.?K?.. ...........3..._..~...?......K...........?...?..@................o.....?.l...G.7u........I..z..K...?....h...s...~..@...#.S.w.g...!............s......._.>..........O.g...._.?.}......_~.....?.........H_........O....?..........{.................O.g.os.....wR.vTTy...@>.Th..;u....`.Jd@.-..Z...}.?3.3..Mo.'....-:?e.".".....2d..,u.}.......d.O......eV.n=..`?.k...El...n.Jf...-.E6.|..#...w(Z.A-.l..S..ja.QQ......*<... ./W.....,.`@X..~.G...:....L:..T/.7....1.......QQ........A.A.9.....m@s...uj.T..%.......A..ky-...zAA5..?.m'.~..>!Q.f.@......bD.L.y...7P.....i9j^71s.^.a.}8s..2Ih....\]l.S... ....h.*o.7IZ.A-.l..Sk.o4.....u.....2mX"7..u.#..I..H..A.fod.#.a...E;.U0'.@I....Z{......-..G.!(.6.)..k<.......zi...Bvs.R...YF..i......6. C....c .

                                                                                                                                                                                      Chrome Cache Entry: 562

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):102
                                                                                                                                                                                      Entropy (8bit):4.921030304008144
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:JSbMqSL1cdXWKQKzaXORdQzXWaee:PLKdXNQKGeOL
                                                                                                                                                                                      MD5:59EE3965FCB16F88E9BDC20B9CD8612E
                                                                                                                                                                                      SHA1:3D93A27E4DAC9DDA01DC5BBCCA9E1F53E827DAF2
                                                                                                                                                                                      SHA-256:020A92F2FB27981D1398F916AE17400F8F11473962EBD858B7BF6901814EDD7B
                                                                                                                                                                                      SHA-512:3E4C07D9CE3DEDE2998A59C32A3FE12D781AAE33C4AFE8D2B9B0D12C18EB96257373098497B5F3C909EC1EDE64FEB4B4074DBDB9678B4D6B019CD64360222849
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=xds0rzGrktR88uEZ2JUvdgOY
                                                                                                                                                                                      Preview:importScripts('https://www.gstatic.com/recaptcha/releases/xds0rzGrktR88uEZ2JUvdgOY/recaptcha__en.js');

                                                                                                                                                                                      Chrome Cache Entry: 563

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):44215
                                                                                                                                                                                      Entropy (8bit):7.97839217732228
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:gGvyJk8FYFkSjgLyiz14beCYi7trcC286Fz9QYZlLLU5OHqaOjAMlam2m6F:tvMFxSjgLTzGiCYi2Cf6d9V/LCOKHAh7
                                                                                                                                                                                      MD5:E01AC3670BDE78937AB48F04DD66EF91
                                                                                                                                                                                      SHA1:9E31EF13BF8668F422F7BCC8B670BBCF8D9B1678
                                                                                                                                                                                      SHA-256:FF8C3CE69ABD41161AF5A4DDC79D844F44C728199E3A098C6A86CE9C9F49F446
                                                                                                                                                                                      SHA-512:19A1F5A457C2349A51EE645BA45835BF4255C210EFAE043AABEBDD31784920B1A79140C9C78D9EC17BBFD5D928FD251D9D22568E23FF6E66A7FD0DACE41DCA25
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://i.ytimg.com/vi/on0ng3OGqMA/hqdefault.jpg
                                                                                                                                                                                      Preview:......JFIF......................................................................................................................................................h....".........................................S........................!..1AQ.."aq2..BRS.......#br...3.....Cs....$....4c..%5Tt..................................D.......................!..1A.Qa."q........2BRS...#...b..Cr.$3...T.............?...QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A...?.........t.~G[O........lX.....h......v.................|.....u.f.P......y....v...?........&.S....b....)..|...W.O.k.>...6'..U...m..VQu..0..+'..a...p.iY4.g+*..P.....@F/Ei..<_.a....W../.0..^..).k.,...........1.I....._.A.....{.....`..'....Hv...L?....v...L7...=.Y.f.kR~`....`...}{...`x..}{....c.~Y...K..

                                                                                                                                                                                      Chrome Cache Entry: 564

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):932
                                                                                                                                                                                      Entropy (8bit):7.790466406012738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:0fIOTOcldz7O7J38s8dzEkqanWHSO9x/HOz2hnCQ8XMX:0bLJA8ndASWHn/HOunD8a
                                                                                                                                                                                      MD5:D28C9CDA632F544CD72F5CC7ED1577B9
                                                                                                                                                                                      SHA1:213CAE0547E8C34D8DA68610CAFE2CF727156E1B
                                                                                                                                                                                      SHA-256:2DD183C9AE13AD1A3872687B71CD2FC3A2CD982C2ABA479A94E7549F08F2F589
                                                                                                                                                                                      SHA-512:BC9BB345B543C114CD0F94156B74E7B78E4CE8879FD02B19FD41276EACAA991A331B439C4E8C79109751D91300F539BD72C974FC31DD78AD2094552CFD76541F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*@.@.>Y&.D.."....8....W'.?... ?...:Ps>..m......;........@.+/..._.oE......nM..O......Xz.z...._.%=yy9.+...RG3...4.K$H.C.......W-.z.].-...A....0].Z.[/9(.....=C..e'\N.....)G9..3=A........2.:...5...T$4z.Y.].1.:......O.9........T.pFN....eD...'8.m)LI..H...B....\w..8.t..........@9.E.}......!.;p}......^.H..M-..i.e.....e~..*$.Fu...../..j-.8J..ySd...8.$...v0...v[[..m:.r......d.4J<U...4cg.... .B{.P..L.)..7..k.j..z.............n].z.0.m/a...B..Q..l.c....2.6.n.8.N&.,.o..x...=.).<.I[.....u......Rn{..*...IU]/..V.w..g{.y..)...,..{CVNH....wL.T........\..<d.."G.3.D...*.i.>Q.....q..o.B....[`....< .....{.(..*..8fg..C..M.A.>.......\9.o.r....x.,..R....iwC...+..>eL..+._:.qx..*..=.... w57I/ ...Tb^.^10.H...h.=..'......._.`.{..yJ?$.......L.......pf.lb...+..2..$....mk.x..!.O.S.u.`l..2.N.8....oN.M...T......o..;.SqvP$R<.h.e.....X..8.IT.9...b.g{..4c5.\...P.G.e......_..m.K.0.].M.d.6.>.H..

                                                                                                                                                                                      Chrome Cache Entry: 565

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 260 x 260, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):5564
                                                                                                                                                                                      Entropy (8bit):7.797375274577943
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:IYR2MGg+Hp1tdVGgEBt1k3T0WHDPYQIb7v5aRKoMEzXJ:5fGTJDGg4k3TUoRKQz5
                                                                                                                                                                                      MD5:658707BB47727B9885675442178C7732
                                                                                                                                                                                      SHA1:5C64187858C53F7621377B27D1B08FE0C6251569
                                                                                                                                                                                      SHA-256:01497A304BBDCC2E2D7621E5F27AEFA1ABCC929C284CA94D7C06514DD950418A
                                                                                                                                                                                      SHA-512:5EA5908996322EB4D38D95D32B8996706B90F25372CEEB4FBAAC2FC5F2E146609AFD04E0327801434E30B08DFAC6366C1FB4D73D2F4B5CB62488A717F061EBD6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/android-qr-code.png
                                                                                                                                                                                      Preview:.PNG........IHDR.............Aj.]....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:F174243DC00311E982EAD97732B44099" xmpMM:DocumentID="xmp.did:F174243EC00311E982EAD97732B44099"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F174243BC00311E982EAD97732B44099" stRef:documentID="xmp.did:F174243CC00311E982EAD97732B44099"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O.....*IDATx.._..U....so...V.P..b..&<..F..#..o..x....| 1.@|3.'.O.....Zc.D...,E iJ..i{.w..9..93..f.9.[..

                                                                                                                                                                                      Chrome Cache Entry: 566

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):21614
                                                                                                                                                                                      Entropy (8bit):7.989915808051685
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:KJfNrPcy2F/u0KJmd6OUA0kTAhgoLbV8zjp2T0cUb/:4r0yuK4d6Oj0wAh7LB8zjMgLD
                                                                                                                                                                                      MD5:00135AF8D59D021189D0C0B35829B646
                                                                                                                                                                                      SHA1:EA62EEF405505EC66D90332260888E00A0547619
                                                                                                                                                                                      SHA-256:8E808D609C3D8A5DD94364DE67F0ADD3F942D847FEAE72283873F7CC42EAFD8A
                                                                                                                                                                                      SHA-512:8488F26A060C9AE368C4768076C77E1519E9B58DC540BA3F9CD782DE461C33A1AA5961217EF2854C9565C81D17E3092699A8793E7478DE0B4A9F5CE5BD5E500B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/mobile/mobile-slide-2.webp
                                                                                                                                                                                      Preview:RIFFfT..WEBPVP8 ZT...`...*.. .>.D.K%..'..:P...gn..M^......n...`._.|...4[{..%..uo..@~u..................w~........#...7./.t....~....f.%......{.'.....K........~.?...?..f...............?.?r........"}.jM.._......C...?.<m......`.......o.-.........?........o...?........U........?...}.........`.........O.w...O._.?5=.}_...G.W.......s...;..........`..'e;.W......N.U..z..vS.Uy;).....U^N.w..'e;.W......N.U..p..iq..t.....~`.x8.o..D..*~t.[..5Q.A.HU.h.9.._.z...m......K.....o... <M..]...`.....ZoGt+.=.0...7.L...R,..=..3t#.!O.,..bb!dTn...[.._)....*. .?...&t.v.2.q.}...=(...I... ..O.w...9.....5.Cp.Fr@..._.z..vS.Uy;).....UN....7d.y.s....p.D...7'...|.:+L[..z..........Y ..-=.KytM.......d..-_.A|' ...b...B.*.N.....h...'..C."...t/.>O27=3...=T8..r|ij...........H...U^N.w..'e;.W......N.U..z..vS.Uy;).. *_+..!...Uy;.r.O.,c.g@..[....!....B/Y......4...6.GMP...}........M...0`jg{.. *....y......32..F..a.[..x:.;...*./_.C...Z..y.5.1.Bpf.c.y..y$.<..J..m...+3./...?....A}...z.o.

                                                                                                                                                                                      Chrome Cache Entry: 567

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 1520 x 885, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):57415
                                                                                                                                                                                      Entropy (8bit):7.714040814048473
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:prxHV0LsrNK1KssPfla+zSS40imFJZAKEn5oC:LosrNK1BM9a2XimFJZALf
                                                                                                                                                                                      MD5:1FAC4DF9B20EAD5A43B7801A9576BAD8
                                                                                                                                                                                      SHA1:C02E2C895BA6C3E565D4B0D12CEE24CD6ACC27E6
                                                                                                                                                                                      SHA-256:0F5210C9EC14B9EBE309F7994F7BA3A5F35058623235DA62D7DB4778700AF1D4
                                                                                                                                                                                      SHA-512:21FB6CA7ABDD50D1CA3B73DF910927A7A8719578B454FEBAE372795357166FF455367F7D0E83352D718A7F243B053734C10E36FF48E029DF7B9F2B1816154F6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR.......u.....0..&....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^......}....]p.^....#.bc...`.#,....`.%#F.$$..f,!!1b...F..H3.hF#..T...*.......M>.....&...|......[66............3..y.......>...u{N...>.........@g!.................................@..........t .|........:..>.....................D.........@.".................................@..........t .|........:..>.....................D.........@.".................................@..........t .|........:..>.....................D.........@."..............u.<.n.1....;'............=.F..............-..Ia.^'.C.O..g...t;.|.......5!..v^=.....f....=Ggs.n>*...~(s.....z,.'........P...`.?...}VM..8.9...WG..U.v..U..H.....h............jB._..k.<Q2.NW......6......._;.<+.....c9...Y..<xT~.......]...$....cS.r.....}nC...!...j..zl..O...s.]....>.&..3.T{.......f..L."........).........95-..!.O....:8..O..WBn.....{g><...........v.............a..]..gm.p`..V.|=...g..f.f....:6....y%s.j.D......:...e

                                                                                                                                                                                      Chrome Cache Entry: 568

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):8672
                                                                                                                                                                                      Entropy (8bit):7.9657826197851955
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:QxhfN+RkTxzurpYeoEkYqelM0WxpjQyyd5P8nJZpqhnCh7e6:QXN5zuOekYbbWxRQld5PsZQhnEt
                                                                                                                                                                                      MD5:4CEA15C604E63D3E7537324F34811098
                                                                                                                                                                                      SHA1:FCE3E1380CF11F7F3318D857BC9E4BAEE82D89FA
                                                                                                                                                                                      SHA-256:653EEE6AA0AE78CD5EF4FD2E3897D198A5422CC5F63F1F667ECEBBE692AAB019
                                                                                                                                                                                      SHA-512:6C3E0893561B7AB8474A3E526EED9B5503721B14275E0641351577D06AC60CD7B97A5F70107DB1D2B5FF682C57573A6E3F71A290B0000E0D522A407085BBB5CD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/87ZWG0h0ohRprr_B-ikfu66EgiL__wNWROk9yW5xl918h0RSzfAjRC4OnIaXhTux_mRW=s64-rw
                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8X........?..?..VP8L.!../?.....n.."..#..UA...gC&../.*.#...X$_..N[.X8.l.v.z.mk.......>.`.I..y-.8.# .@..5....$........_kg.?.~..O..2...@.!.&.(t.\Q.;Q......b..yA.b...f.b.."SH)MPZ...P.dEV.y.._s..j>U.4..U}XR.:..Ws..U..3.....{Z..*4.b-.J..g..r...P...?.!"&@...N.#.Q@..`.v33........@...-/!..l!J..3'....)~...v..te:r..'......1.03....t?]Z.e....o.rCI.$..........y.0.4....4.N.....{.t..H....Zz....i..$...v..2&.....\K[.....M*I..\..j.m.6.m...k.NR.B.*G..=...{..hwg.YC.v....l~BO..m..lw.{d.....i.m;.S...&. ip..,0u.-.........L..]:..u.@....\.u../l..I..<..8...kZc...Z...Z.m..v-.ms.rufVfD..._L..Z..e.9..j.....dP".*.9..g.3g-.....\...+.]..m[U.y.}....i.R......."..H..h...6.....ev.9..;,?..'...7?.?.....). ..(.(@$@.@..W..0k.......m.*.X..c.......Rx.1L@.@.D.. 6..A.*.XV........b.YD....0=...j..6.<.(@.....".p.qj.V...:.}...8..K!.-$1*.. ...._.W.t ...4.....>.b.T..Y..m....L..d.....S.!.@P..KRAc..g..*. Ra2........o...zl....XN..>h..\d..F.Fn...i$.fI.i(.<.q:~u...jB..$A...Wk.XU}.

                                                                                                                                                                                      Chrome Cache Entry: 569

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37658
                                                                                                                                                                                      Entropy (8bit):7.994897732347311
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:TcLp/YW4i3iSAv1E9R6rYhOsr+yP/xImd8BIB01iP8mks18VK4y5:AGsFAvwgrjYNPqmhua0K46
                                                                                                                                                                                      MD5:7090B63ACBEC7EE45513BDDC66AD4830
                                                                                                                                                                                      SHA1:08DC4311CA095FEA0628CC8A8123DE300C6F084D
                                                                                                                                                                                      SHA-256:41799BFEFFBEFD1B0A4EFC6AFB98EB7BCFC96319A00DC81A9896942738ADDC2B
                                                                                                                                                                                      SHA-512:59CDDAFDFE470FBAE2D08B1DEADADA9CAAAAC576B5E06797A82E4B65FADCE9B845EB9F89F87FBCB632E39AD79774B939E16D710D145769AE3726F8BEF663C6C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."..j.@.D.5x.C....#. DH..3,..g.. ...>p....>..k...|W./5.......W.............../..'......J~...{..........o....._..z=.?......Y...%...k....?./l................4?U.s..w...q.S./7}.}#..........!.#......}..._..............{......?....9.#...............}d.C.............?........?./.............O............#.....?n..}K...............E.g......g.....?._.??.;.0|..Uy..m.u.W..{..9"c...sl....(..&....N..f.....X.rXu.L?m.Z.z......bt.sO.R.9......;...K=[Q?...e...T=z)..D/..L6..Z.........X5Y..1...ir}.T../.,J.F..Z..x,;..YZ...,...\.d4..}...n...s....(...z...D.G.j.Qo..0...u.%Zp......K.......!..(..Ew...S...)EVP.*].....y[..!.K5.Y ..T....'....G...`.h....4.z.d.5[<.".#.#...;..#.y.....f....c.....ZW..."...U..#....\<n?.{b....{..qQ..B.'.O$v...L$^h.U..........Rc...6....^4EwC.`>r2.C%.oBL|eG....[.Z..F.e.....ov.J.[O.\..Q".....!..5.....3../A.k./X.:L..5..e2....?%...?/e...,...D.IJ..gs....z.............P$.Jw..T.......ra..).../.._f8.h.\....

                                                                                                                                                                                      Chrome Cache Entry: 570

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3798
                                                                                                                                                                                      Entropy (8bit):7.9369350615154355
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:k+a5wwCBr36JcGiI4c0nB1/ZbFXmJKlF1xCm5nLJZ3A9Uo6DIiIw/MtPK:KwwzcO4xnB1/hsOFum5nLJZ3A9Uo6DIa
                                                                                                                                                                                      MD5:F85FD91DFE24644E8C231513F3CA8D75
                                                                                                                                                                                      SHA1:D576BA13B30AC0A01380F11D9FA492C300DB1603
                                                                                                                                                                                      SHA-256:EFBC2D113C5B188D10D125657C6E6CF969759E0422B4CC5B01583A35E2CAF2AD
                                                                                                                                                                                      SHA-512:BD43A9853316F4F4AA4C8DD92511FF924BFA6BAE9BA795F106E40450276FF3EC9818E8B00241F8B0C4F0BA8482A0DAF673949A6B1993872E3ED83354489EC772
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/image_more_4.webp
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........)..'..ALPHb....w`6..R.(S.b.....<.5..&..(m&.O.H......PB..............5....M.+I..I............?.....G=H2FI.I.em...VP8 F...0K...**.(.>)..C!.!.L.X.....p...{...k.,.F..1.n~...z..?X:.|.uYXO._.?8..v../..!..}S.o./._....#.....?.........T.W...u....D...o.....|....n.............*.......?..{....w...w..?..i.....K.....W...........K................i...K......D.F]<.V......t.yV.(....R.-.*cC3..B...........4.....~.&.....W.?..8.w.k,(..[".%o.cy...x..A@-.5.........U.F...i........$.2...-`.Y4..?.Y..p...7)...o,..........l(.h........KX..**.2.._....@.....*..P.C".cpg.2.}...yZ....#.9.'.....&l..y..Y..l[.O.]....}.....:.3....../.]..........8P.ET.........OH..c.A1vI.0aR.....E..*...nK..O7..2...F]<.V......t.y[#..o+de...l..y....O .......PrI.?.n5......a.EO<..q..KNdA..2u......t....f.......O....B!!.a.T.-..x....LE...`9..8...I..9!*..+..D...U...(e..?3k..p.......z...... ............g...w..;7mQ....&Q.||9.3..9......H...y....HpNC2...WK+.........R.Xo..qu.......

                                                                                                                                                                                      Chrome Cache Entry: 571

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):10976
                                                                                                                                                                                      Entropy (8bit):7.971626582681124
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:T7w6vtlMEwNgHAZ2TokDc/2rmmx6AAjFC7cz5RHVvSjuRDU+T62oVFF2:Ts6vtlJqggYToq76AAjU7eEjODUc4jk
                                                                                                                                                                                      MD5:BBBD4BADE7B797983D02E822418CA387
                                                                                                                                                                                      SHA1:23F5227C99B6C719E19A72D7AE3E21F0B8110457
                                                                                                                                                                                      SHA-256:516154F6357DFD7740297F8657E75F0095C9EFD390BBADBFD8CC981E02610D9C
                                                                                                                                                                                      SHA-512:7D711C2E28B820DF6503605B0550C255C9DA2D0C3B7E4F1920B172E42837EFCA4A0D426D4F334DF7A1ADCCE6EACCD0B95D35AE2AFB046694D70563BEB16883FC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.*..WEBPVP8X...........'..VP8L.*../..I....m.i.............@9.r....]..v...wn....Kz.W..w...{.q";..^/Qz...M..N.}{z..63...K...;J.i....j..A/. 4.A.......n..?C.o...\.Q..M..f....v..j!.K.P@.Kz..R.n.1i...2.y....J.i .h.d...j.P(.BBy..r(.aKn$.$...G....7.."Ir$.c..<..ZLw...(M..Zr^..f.m.m....5....yW=...;q....Jo Ug..[Y.z....Y.>....m.....F.U.m.m....-.0.......m.m......?....T...FZt...}R.K.M......0....M]&.[0.m.kE...F..SL0....v.-...N.lP..(....Q]..q...v..o...hPq......q.[L......7uZ...m(...*...R.....Y..D.A.$..B._....s..,.O........R..%~...$.v...<jr..[..o.>..<...&}...XGu..g\.nM.h.k.y.f...C.H.g.. .a...Q..YWeH&...C!.s.....z...0.O....3l&.....$.Q...".B.H..\.tk..'r..(R.Q..#..O...D<.j5.(....u.n3.....#..c......@...-.;....L....M.>.......^...j....^;.fr./..LM..f.}u....*....k.z.%.....0}n._.Q..\.......(...u....UG&%.U.w..i...o=........Ip..Ob..\u..m.. ......VI....c......5U!.F...z...s..(...~4.....e...{>j.lEZtT.q....Ff.w.....G......4ij.=lx.g.|...7...c./w.3T&....noE..

                                                                                                                                                                                      Chrome Cache Entry: 572

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):4336
                                                                                                                                                                                      Entropy (8bit):7.833212598431787
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:8YR2MOuraBXB1EcdV52FbF3N4yPOGWbgAli+hrnsumaL:NfjAHdLIbjWJNd
                                                                                                                                                                                      MD5:764DC7C4F9747AFC913F4B38C1EB9871
                                                                                                                                                                                      SHA1:805284BEB4603FD46040431BDFDDA42B636ABC7C
                                                                                                                                                                                      SHA-256:ED0FC7A2ADC70BFB82F669563216214B75D557EC63CDC750742252D35DB230EB
                                                                                                                                                                                      SHA-512:52707C502C46471D2302AAB5594D5CAB7D802AEF3EFEBF6FDD108F2434CB41BC35CA79398A5A101DDEC28125EC879F6366BADC2A59820934E4103B146DAF632A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/start-download-icon2.png
                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:30D3167DA48411EAB05FA6B755E57B72" xmpMM:DocumentID="xmp.did:30D3167EA48411EAB05FA6B755E57B72"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30D3167BA48411EAB05FA6B755E57B72" stRef:documentID="xmp.did:30D3167CA48411EAB05FA6B755E57B72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>7/.....^IDATx..]y..U..^..fw...{.&....C..$.!d!!...HA,.....--.CK...E.D..B..@ .0...jD..rU)W.f!$;...;3....<..=...3...

                                                                                                                                                                                      Chrome Cache Entry: 573

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 458 x 458, 4-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):465
                                                                                                                                                                                      Entropy (8bit):6.05785253746322
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7ElAi7XzyE2dbfsnX7rG6EzstzWXcdXy3x:EDE2GPkAoM1w
                                                                                                                                                                                      MD5:143B0F6438909F4F68948A08FC48AF24
                                                                                                                                                                                      SHA1:F1083367EB950980670440FC20EF482532F1289B
                                                                                                                                                                                      SHA-256:16A808DE19CC4D477CA3A807F630156644F7CB0DB5D8CB6E1B69D758524FA253
                                                                                                                                                                                      SHA-512:8E4D74862B28B897C2E469C74BF4D36B157CBBAF9E5AF9DD21443732F9D68E6D0836F9E92BF06265EEFC84E6F50676BCF118937B0C0D9E57DA0B5EDBC11B0735
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR.............q......0PLTE......,.....-..-..,..-..-..-..-..-..-..-..-.....e.......tRNS...'..........1......bKGD........5IDATx...1.BA.E.?_.6......V..:*.`....b..9.K.....[z.;.F\./..."^.......a.../.c.....a...K....p.........................H.0.6,=.6l]h...k..m..................0.m.D..X.u.mXw.m....!..................|...m..cm...a..a.......................6L..K...[..u...+k....................G.0.6,=.6l]h...k..<....z.f<..z....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 574

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 36, 4-bit colormap, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):185
                                                                                                                                                                                      Entropy (8bit):5.9780303893393345
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlSYLl+1IHCRsHrXLRa+dn/23rIIGU5thNnkncm3w4qtmkW7PXl0VMa:6v/lhP0YLkyymvVGtjnUnRq0kW7N0xVp
                                                                                                                                                                                      MD5:07505E9DAC6DD922116F038EB58C9B88
                                                                                                                                                                                      SHA1:4DAB9005E4603F76A6FAD92FE78FB9C92D05B62F
                                                                                                                                                                                      SHA-256:C4DB75F643BB4DD47E39A9601FCC0A14621B588D5E4EBE987EE4828120BDE791
                                                                                                                                                                                      SHA-512:5A94B97148037E9A25AF768AF67A1AD5D4959E5D5C216DC5353FB159630302A74A990CCA20F787C024C6B7229A12920B287A88A4063514FBA534E7D1DB094C11
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://ssl.gstatic.com/store/images/regionflags/us.png
                                                                                                                                                                                      Preview:.PNG........IHDR...0...$.....=k.9....PLTE"u.#t."s..OO.PP.OO.........o.......tRNSJ....J..J.j.\...DIDATx.c`T..ec$.. .].A...1..Z..!..%p.A....H...0......*.....]...Qp...al.....IEND.B`.

                                                                                                                                                                                      Chrome Cache Entry: 575

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (5945)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):279903
                                                                                                                                                                                      Entropy (8bit):5.612135670818199
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:c9/pmFU73li04d7G3BsEemvelNPH0fxnP4:kgW734nhifw
                                                                                                                                                                                      MD5:0D8FC66E7BB50DF0F483AFA5CD0E07EB
                                                                                                                                                                                      SHA1:F2EB9B9DC1C7ED775AD231F93060A49C3D1D1EBC
                                                                                                                                                                                      SHA-256:780FFF4E94F61242E80B4C28804FE535648A8AC6706F04DADA2B3F85DCFDF1A2
                                                                                                                                                                                      SHA-512:FDDBC6A4C08F25DE7B128D3DD358B90B3BE2B36F956B5D830C8FBADD0543CD6A7A08F9C1F62DB0F29A04E396A9E39387DC4E544A14B555FA7CC9ABFC890E4EB5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.googletagmanager.com/gtag/js?id=G-9232N9ERWJ&cx=c&_slc=1
                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":8,"vtp_value":true,"tag_id":10},{"function":"__ogt_referral_exclusion","priority":8,"vtp_includeConditions":["list","neat\\-reader\\.com"],"tag_id":12},{"function":"__ogt_session_timeout","priority":8,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":13},{"function":"__ogt_1p_data_v2","priority":8,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SEL

                                                                                                                                                                                      Chrome Cache Entry: 576

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1168)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):19055
                                                                                                                                                                                      Entropy (8bit):5.641313119370284
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:iavkvyX8WBVDB/vPovschgFNad27Ih+ybKQhvUpel6b3ERwggOPH69RNV+/as4D0:iavkaX8cDpvPovscuFNaM7Ih+6KcvUpy
                                                                                                                                                                                      MD5:40D3F728636F2CBD23C0174842236744
                                                                                                                                                                                      SHA1:DFD89C1AA0EC92DB7AF36CCBE1944029884AF49A
                                                                                                                                                                                      SHA-256:A3173514C3094A6751540466629A87DF335C4F5DBF97CB59A717B15E83CA1131
                                                                                                                                                                                      SHA-512:ACF06CB56382CE4C89B3D7BF61524C0057B6B97B6951FCAFC248F19EDE6DB5E140C20B6A2A7FDC2369D28E20618C189348350A821EA5A49060B770AB8BBAA1C4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,EEDORb,EFQ78c,GkRiKb,IJGqxf,IZT63,IcVnM,JH2zc,JNoxi,JWUKXe,KUM7Z,L1AAkb,LCkxpb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,QIhFr,RMhBfe,RQJprf,RqjULd,SWD8cc,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,gychg,hKSk3e,hc6Ubd,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kjKdXe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pYCIec,pjICDe,pw70Gc,qfGEyb,rpbmN,s39S4,sJhETb,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xQtZb,xUdipf,yDVVkb,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=dfkSTe"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.rf(_.upa);._.u("sOXFj");.var pxa=class extends _.Cq{constructor(a){super(a.ua)}H(a){return a()}};_.Dq(_.tpa,pxa);._.w();._.u("oGtAuc");._.gxa=new _.ae(_.upa);._.w();._.hxa=class extends _.Pk{static Ja(){return{Tl:{aZ(a){return _.Jd(a)}}}}constructor(a){super(a.ua);this.soy=this.Uj=null;if(this.Qk()){var b=_.Hj(this.Zh(),[_.ek,_.dk]);b=_.Pe([b[_.ek],b[_.dk]]).then(function(c){this.soy=c[0];this.Uj=c[1]},null,this);_.Qk(this,b)}this.Oa=a.Tl.aZ}fp(a){return this.Oa.fp(a)}getData(a){return this.Oa.getData(a)}jr(){_.ml(this.Uj.jf())}eH(){}};_.pr=(a,b)=>{a&&_.ce.Fb().register(a,b)};._.u("q0xTif");.var jxa=function(a){const b=c=>{_.Yk(c)&&(_.Yk(c).qc=null,_.ar(c,null));c.XyHi9&&(c.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(let c=0;c<a.length;c++)b(a[c])};var kxa,lxa,mxa,nxa;kxa=function(a){const b=a.Ya();return(...c)=>a.Sa.H(()=>b(...c))};lxa=function(a){const b=a.W();return b?(.

                                                                                                                                                                                      Chrome Cache Entry: 577

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):32120
                                                                                                                                                                                      Entropy (8bit):7.992132365032467
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:SYv1F7EDDJq0L6QatIRJBcRiUP+WbcwgP7VigH6vWk/vOJyje:31dwDA86QatIRJkaWbcwg4gmDCyi
                                                                                                                                                                                      MD5:741F563A1868F2C5C8D778D21B2A381D
                                                                                                                                                                                      SHA1:D27BA4D2E88F979789DE84AC1E7AA8F45B0B6652
                                                                                                                                                                                      SHA-256:09FA8FD5A9D7B00A9475A6C37682A9216235E2249050BBFD1F002283DB93D715
                                                                                                                                                                                      SHA-512:29CEA601D30031EC09C38C6529B4B1204C59D3C89E841436231147DC07F254233F9677CE5C6A4B45E56DA9E72AB0F1BAD04BC62FA0B589432DD0F4D90EBC9877
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFp}..WEBPVP8X..............ALPHM......m.i...j+vR..m.WG....l...c.N.p...f...Z{.9cT#"&@....C..9|..."+ `I.....6...!..(k..Xq8..+....Z....a..>.*....M9t..(......j.....E..{9..f@...[.: .... .p......xw3...<.P.l{.Qs............%..>...=.\.-..g#.'.2.t.0{..h......./...F......y..;.k}.....h.'.s..M..|.p<7^7.....$...Oo]..L...<}Yu...G}.d.\2.._j6.....F.[...j... ...L....U..|....l....Zc............cE;X..n.{c-UBJ...UY....B.....T....A.s.g..).|.h.D....lIE?..!...6....f...(.PT....`EM..7*.A.7\.. .s...L........P.......}7.#D`..q.A..F.f>..$..T.\......E..2....62.%u...QR.d._H8...........t....!.L..3.A.D4..\....H..!,..!.....?....m.&..M..f.L.@..?......3...SKj...!....{./..<.......H....R..a.9..].7-.X.S.......G......'.!B.!....W01.w.H.%..g...?r..2u7-l. .-,.....a..G.b.>].AD.C,.....c......?.......c......?.......c......?.......c......?.......c......?...... .....R....H"...J...`......I.xC..I..J..$.n.A...A._H.".s..V2.%.....K.".t!......r...T...*h##...)Pn...w..O..!...(........0.+.A.7\.4

                                                                                                                                                                                      Chrome Cache Entry: 578

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):834
                                                                                                                                                                                      Entropy (8bit):7.744071106244072
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:n7S4DstdrO3r5z5Js8he9D7Tjcpve0It2RQJPTmy:nO4DsteVzs8Wvj1LNmy
                                                                                                                                                                                      MD5:104D12720A57EFFE71763FCAE58A8319
                                                                                                                                                                                      SHA1:A0000897B2C258619963424378FDD95B7BFB635C
                                                                                                                                                                                      SHA-256:F0892D6CBB859336F59AC8BC48EF20E6DEE49D72FCCE038D510CD875D6DBB41C
                                                                                                                                                                                      SHA-512:CEC9AE6259219DD0F0870281AF6A69664FEC640ED4650025D2061BBB575C30796A7EC36DDDAE5BA693B9D48F5FD222230889B0529F994483C8A6858B30AB652E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/o0VxBNa4iLU3aoSSz7eD9Yy1wKrLEeqEGYWVOclI5Uqy38mwIYdMfbSf0Zi5CCZ2Gg=s64-rw
                                                                                                                                                                                      Preview:RIFF:...WEBPVP8L-.../?.......$GRT...q.9.m.....$ERfu....&<N;l..$......._.p.P..@.@..e0...>...Z....q..J. PP .B@...a.BA.O..|G.o0(\ .8.......Ba....... .*..........1?....-.:........3#/...|.r..b..b1fi..cDm..^..Z7.K......G....hW5>...mw.....^...`I`Uj.A.5F.T...@<@tmo..H+.q5.........E}.kF,bM.+U!...2jB.T.8....RP{.........0..m..y...w..fd73._.[.m.f.m.......y...O...<.#l...rYI..R.......%....Z..r2....,p.$..2b.|:YN.z#.w+N......B...y..4.D..wv.|"QI.....w*.RN...y..%u.....2)Ea.l.....)ZB&....2.B.....%#...Am..gJ...t..r....P....l?.K......vs...H..NYm......c.t.t...azi...GW.u.....N....."..K.1.>H..0.?.~......?..\.e....^7....\........G..d%3~%.\&z.....3O.3=]......}.)>G..{.OH.....y..].. KUD(....t4.TUbLGc.;m....6^..b..X.......4z.....ocB...:.k.1*i....o`h...m.Fn>.-.K.A.X....M....r..Eu...nx..a.Z...r...j4..X.6tV.....9.....

                                                                                                                                                                                      Chrome Cache Entry: 579

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):97906
                                                                                                                                                                                      Entropy (8bit):7.988101683057573
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:x9oClSIDLCAl6g+8o0zWQjgsvs08QS8r7DUMBPxp0toc7OKObY55:7r93CAnNoM9dj8onTBPxCmc7hOg5
                                                                                                                                                                                      MD5:1868B67F1EADD355F1135028ED909AFC
                                                                                                                                                                                      SHA1:43DF74D2F617C49C4EC41BE8D0A3C15E20629E8F
                                                                                                                                                                                      SHA-256:902C48DEBD8C4972AD0FEFD712764163D9993AD5EC45B13E1F0A8ED0F682E03D
                                                                                                                                                                                      SHA-512:DF8F944D052B73BBE462BE9DF467919B020FCC97B293283463C42713C8005A73F84DD69DEE5568A6422B8FE96F14503DC0F7576C662D2E487E9166191711DE4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/D4DUUFQDCsH9NIEa8hjMjQSWdtNhGX1Fd_jT-23ogAb5uMMqttqQDUJcUt4K_u8RYOQ=s256-rw
                                                                                                                                                                                      Preview:RIFFj~..WEBPVP8L]~../..?.M@l.F...=........5D....Q.<.H....d....la?...6.=z.]...aW.....~.v....ZUc1~m.=..(.d...g...;I..'...93.3.(I.#u......#%..........J.-I3.fV..+I)/3R{KZ.-.'u'9.>.j....Q.aS.V.................N....nc...$.F.9....G.:IZW..k.....Y9.II.^K..,}iut.. .\..}I..\.X.$Y...$'.....K..........G..7(......f..$...$9....JI$.UTU..5I+..._..`..(I.....ff.3-.].....$..`I.I:..s..Qk..]T.@....3...."I.l.(..h..U.x....%...]14M..:(...8t.B..1F\z.2m.U.......c.#..B...m.Q...B(.J3....7.w..QX<.....k...@.. dk..)R..eb.:...........-.....;`... UJ.W.n..Z....;s'.=..J.Z....].......@....!|...L...[.}.!.S..d.F:...x.(@....w.N........hrTs.....mP[[....H.... ._&01.....K._T....&..Q?.Nj.K..q.MDF..X.....g...OyOw;.f.$.6:.I..W.U.....]...Vu.....t...x...h...nU?....].^...6..#......vF.`......"...Pb..Y...j.C.C.PS........8.&......]..k%...+....6....6\..M.2.......8.V.......%*..+]4.3.V.6..W..|.o..ttv....>{..K...wS..J...:X.5..f..C..}.N....vW.......X."s.v.r...v.....w...].T.....J.Bj.7.....x.......%..](

                                                                                                                                                                                      Chrome Cache Entry: 580

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (28115)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1134323
                                                                                                                                                                                      Entropy (8bit):5.702482149471141
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:2soLRr3euhPtuAOOic7ebbFJrGE8qLOIZZ0VLzBD/0X652tyvQn9l2EvqauHVr/4:2soLRr3euhPtuAOOic7ebbFJrGE8qLOm
                                                                                                                                                                                      MD5:E0EF20C0596DDD4F6221D25FABD0474F
                                                                                                                                                                                      SHA1:51200F20A2FBF17374A279AA3248EAF40A7CC9FE
                                                                                                                                                                                      SHA-256:FB783AFE1433442C486419596B4FD56847D698A7B68240DE83CAB33E025C841E
                                                                                                                                                                                      SHA-512:A0E2241C0BD10DB59260D3677961C971624D69A63ABC449CFD06452F5333B84A20D63C15855B3BF8824C16CB6E249196024634623F8F5C3D9E68BF899121F0AB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".EDId0c{position:relative}.nhh4Ic{position:absolute;left:0;right:0;top:0;z-index:1;pointer-events:none}.nhh4Ic[data-state=snapping],.nhh4Ic[data-state=cancelled]{transition:transform 200ms}.MGUFnf{display:block;width:28px;height:28px;padding:15px;margin:0 auto;transform:scale(0.7);background-color:#fafafa;border:1px solid #e0e0e0;border-radius:50%;box-shadow:0 2px 2px 0 rgba(0,0,0,.2);transition:opacity 400ms}.nhh4Ic[data-state=resting] .MGUFnf,.nhh4Ic[data-state=cooldown] .MGUFnf{transform:scale(0);transition:transform 150ms}.nhh4Ic .LLCa0e{stroke-width:3.6px;transform:translateZ(1px)}.nhh4Ic[data-past-threshold=false] .LLCa0e{opacity:.3}.rOhAxb{fill:#4285f4;stroke:#4285f4}.A6UUqe{display:none;stroke-width:3px;width:28px;height:28px}.tbcVO{width:28px;height:28px}.bQ7oke{position:absolute;width:0;height:0;overflow:hidden}.A6UUqe.qs41qe{animation-name:quantumWizSpinnerRotate;animation-duration:1568.63ms;animation-iteration-count:infinite;animation-timing-func

                                                                                                                                                                                      Chrome Cache Entry: 581

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 34108, version 1.0
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):34108
                                                                                                                                                                                      Entropy (8bit):7.993096562158293
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:xDa3S2Rdcc3/k1/3Sr8dgfqHwQGMIto3/fIpos4GbtJzxn:xu3SQ3e/3S43TUtoP4Ftn
                                                                                                                                                                                      MD5:C15D33A9508923BE839D315A999AB9C7
                                                                                                                                                                                      SHA1:D17F6E786A1464E13D4EC8E842F4EB121B103842
                                                                                                                                                                                      SHA-256:65C99D3B9F1A1B905046E30D00A97F2D4D605E565C32917E7A89A35926E04B98
                                                                                                                                                                                      SHA-512:959490E7AE26D4821170482D302E8772DD641FFBBE08CFEE47F3AA2D7B1126DCCD6DEC5F1448CA71A4A8602981966EF8790AE0077429857367A33718B5097D06
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
                                                                                                                                                                                      Preview:wOF2.......<..........................................\..4?HVAR.t.`?STAT..'...J/<.....`..(..Z.0..,.6.$.... ..B..K..[.h...c.....nC .../.V.v..6>nT.*R...b.8.@.......ON.ch.......k..."..".9..\D...JBJ."T%5...Z2..Q.)wJ...sA.h..m....n..F.....t..ig.=..y.s@............t..j.*....n.h(...........N..)9.....v`|z....8.7..kTq....^.......[.K.O..1ZP.....;.HP.......>..+..j:.V.......A......[.f.l..v`x....F_..vo...e....n...H..X.2.v}...(.1J...x.....}.....5.3.....?..?..7...S..0.9..C.0.M..M9..e.b....bc..b4.0"e.G.....XT....z............E'c.(."...x`].]..e.rQ..ye.z........kFh;....Y.yPt.._Q.._-q..mi.Og.W.-qUI*...m5..r.mvA~o....S.f........s..ql.aXD...H..wy.P..k...f$.V^.2...8U{...f.....]]..G..cf.......D.c&B'S.2~..N..........R;..).5...../... 6....b....]d6."C..T..........OI\+V'...E.[.g.u.E....,*!F.....*U.q. :x.s..1..C....H..S%..)....h......K..........pw.f...f.......an3....9....@......%.2.c.+........cXD..F...B.....0'...O.z8.B....4...\..&c...H....;..p....@.l...:........L..`...5..xo&.

                                                                                                                                                                                      Chrome Cache Entry: 582

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):695
                                                                                                                                                                                      Entropy (8bit):5.125487126436221
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:YGKhFsiGM1KxMh4zjv8phy8sBhy+oJWZ8t5Eh4KWZ5+oJWqs44CP72EtZ44XuPSb:YdhnGM1K2izjv8qDCsZ8tWiKi5sqEC97
                                                                                                                                                                                      MD5:5AEE85576DAD928921F179713A5FACC7
                                                                                                                                                                                      SHA1:D2A0A4B93F0EF58FDEEB569917603C68183D2686
                                                                                                                                                                                      SHA-256:7E0781E4C2251D021988B95640DD00108B002C01DD607850AD21C5E72B50AABB
                                                                                                                                                                                      SHA-512:7075BD5127AAA3F688D012C2546DA42A9D7D5835D11605051F0802D04385BE48012B3DAE29E9981CCD13C208E14593E2AB9D627351948D2D4A4B324C9DA39435
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:{"code":1,"msg":"There are currently activities","activityType":2,"activityData":{"code":"JTMRW","param":30,"createTime":"2024-09-27T00:01:00.000Z","expireTime":"2024-09-29T00:00:00.000Z","activityId":954,"activityExpireTime":"2024-09-29T00:00:00.000Z","activityUnixExpireTime":"1727568000000","activityGuid":"83f4c120-7dc1-4372-b266-ca17c2470b3f"},"activityData2":{"expireTime":"5 hours 55 mins","activityUnixExpireTime":"1727568000000","activityInfo":"Limited Time Offer | Get 30% off for Premium. Ends 9/28, 11:59 p.m. GMT. Learn More >>","activityMobileInfo":"Limited Time Offer | Get 30 % off for Premium.","activityGuid":"83f4c120-7dc1-4372-b266-ca17c2470b3f","code":"JTMRW","param":30}}

                                                                                                                                                                                      Chrome Cache Entry: 583

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):16242
                                                                                                                                                                                      Entropy (8bit):7.9402572379727125
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:Xuw19G/c5AIyS87w1YRmRAjkECvcFd/NP5zOoYJw0:P19GU5T587wiAsw0H/NPeJw0
                                                                                                                                                                                      MD5:6B2CB8AD472A93B0D97FEE592C13E1AB
                                                                                                                                                                                      SHA1:F40C495C1CA874FE508F6F69059041A5243D9A38
                                                                                                                                                                                      SHA-256:49CA14F45BE05F2A2CB10304CB6481A9A18E15141819C86D15E8891CF371AEC8
                                                                                                                                                                                      SHA-512:7C63115A9EA99072CC01CE04D354952C4EEC03B7CB781186199F6D45967A7FD5D7E190B2810D671F53A03A6B3964AB1B7F7A4D84114EF3BCDA7BA4BCABA23C1C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF....................................'.....'10-'--5=PB58K9--EaEKSV[\[2AemdXlPY[W......./../W?7=WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW......h....".......................................H........................!1.A."Qaq..2RS....#B......3Cbr...c...$...4ds.........................................................!1.Q.A"2.3Baq.#.....$............?...B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..B...!..N..N+.P.?...8.n....Z.>H.9.N..N+.P.?...8.yC...L5a.G...t.bq^...}..{..g.a...>.n.......<....N+.....K.|..sp...W.G..LO...n....i/B.a..a:/...n.....C1>.......a..a:A.N$..yC...Lp....(y..V?.>.f.......<...../.P.?..X......O......3.1.b.>...i/B.#..!:?.x.yG...L>..}.>g.c.^.....Bt..O.....;.6+.P.?....?.>.f.......<....6+.P.?..Xo.g1.....{..g.a....(y..7..........3.0.....<...V....Bt..a.^....a.^..3.0...s0.Jz..c...?.%?.w....;..4

                                                                                                                                                                                      Chrome Cache Entry: 584

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (3034), with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3064
                                                                                                                                                                                      Entropy (8bit):5.4268052346910025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0E54uBXNdAwhrQWgmMDgHoxphyhBHKYfxADAWLSHukLlLqEV:0TudTSgwM/n33V
                                                                                                                                                                                      MD5:62E10CB6AC535EF6143B72676A0D896D
                                                                                                                                                                                      SHA1:A7492B4C7A30B6BCEF4388DBB14D946779479B49
                                                                                                                                                                                      SHA-256:E73DC7F61E37E47FBDF5E22A1AEA6538E61C87BB06B0B8041AD582BA04363828
                                                                                                                                                                                      SHA-512:3DE5CE6A3DCEC6A5D50BAA5F2CF1C6BC463A9A9A903814135D1BB7D4D275B4CA68C6C9FF07C443E5A41E6216B680ABD0BBCE36A51CA1510D6CB20B2A2DF6FD30
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:!function(){var a="@charset \"utf-8\";html{color:#000;background:#fff;overflow-y:scroll;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}html *{outline:0;-webkit-text-size-adjust:none;-webkit-tap-highlight-color:rgba(0,0,0,0)}html,body{font-family:sans-serif}body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,code,form,fieldset,legend,input,textarea,p,blockquote,th,td,hr,button,article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{margin:0;padding:0}input,select,textarea{font-size:100%}table{border-collapse:collapse;border-spacing:0}fieldset,img{border:0}abbr,acronym{border:0;font-variant:normal}del{text-decoration:line-through}address,caption,cite,code,dfn,em,th,var{font-style:normal;font-weight:500}ol,ul{list-style:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-size:100%;font-weight:500}q:before,q:after{content:''}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}a:hover{text-decoration:un

                                                                                                                                                                                      Chrome Cache Entry: 585

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):19756
                                                                                                                                                                                      Entropy (8bit):7.989522453302349
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:D3q4SFgwI1KV3D5t9dkkW7a4XtE4SWyg6EsNsnE3Au+XSDgB2nsvWBOo:D9kgsV7QL7a4x1ySGsiW5vWAo
                                                                                                                                                                                      MD5:F7F13D43A67E989C89EA473B3F00E1EF
                                                                                                                                                                                      SHA1:48F4CFC4294BE0C90A1244887846C4887E1C14BA
                                                                                                                                                                                      SHA-256:FBE94B2E39E1DD5177A34D2C30598C51996FAA0B2165F9D9E40B2A18FFA4BED8
                                                                                                                                                                                      SHA-512:90D97E0AC39B42B36F480CB0C27E83D80982E5282089E56561874E84B4F7686EEDFD740949880C94F23BDEC539F9CA397B5E9A009B742F375FA2E67E37949EB4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF$M..WEBPVP8 .M..Pc...*.. .>.D.K%..".S....gn..U...;.@.......>.\..G.29.wR.T.'._..>.?>.........K........~..p.\..~.{......{...W..ao...=.|..u.................b=..]....>..n.7....C.oR.~..o./i.......'./.o.}B?0.......n....;.....||....^.}......_.O.......e.........._.....U...../..........;..............?o?..Y4L,.&.M..&...D..ad.0.h.Y4L,.&.M..&...D..ad.0.h.Y4L,.&.M..&...]...x"qY.2.3^B.X..Z.q.38..3.........m......}.......~1..JoL,. D..>.f...P%7...m.....x@M.[.u'.....k"/G..y......E.'...<..P?..2....nTc.... .4...'.a6.ph0..#y*.0...YJ......*......L.v....2....v.J.K.#......y.B...D.N...xb..gz.C....l...H.c6.1....Lf.....m3....$!..a@.5p&.kA......G.L..."..._&.ZD...&.8..B.."P..f?....Z .6O.K_.<..{9u."n.r3..MQ1.."..-....x...r[,.i.j.>H.n.`|..b.Y..)....?....3].D..S..Y.A..+@....Y....U.",...E......9....e..)86.._cM=....$v.BY..WQ.H..Cl..GT.Y*'....'^.HI....r..`.g.o,.D1G.t$.9..C.`p.....l.X.'HE..K.J......D..5h.h.Y4L.0.h.Y4L,.&.M..'..&.M..&...D..d..D..ad.0.h.Y=..0....j...i..

                                                                                                                                                                                      Chrome Cache Entry: 586

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37288
                                                                                                                                                                                      Entropy (8bit):7.994762848094783
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:UQSzY+QT8ixHcLcMPO0iDX5nGViyewu06tKiCMSrCgTFEbg:UQSzJQCLcMPO9X5nGViyej0dph
                                                                                                                                                                                      MD5:156C2C8098F1F956D43EF04E6FC6DFF4
                                                                                                                                                                                      SHA1:5844EF40E7C70C89F8B30E94E3EF7DE57F37BBD8
                                                                                                                                                                                      SHA-256:5A79395E0FA29B172E332D0600B70A3B90D36C425421C16F514D087B50829571
                                                                                                                                                                                      SHA-512:E0722ECA4C570C68D21739F407FC18E5FC3695DA344516EDBAF226FC250F1B989B6B34C2A132D6EB95CC1FD8F04D757E277DC104931C98C988ABA495FA00DA49
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."....t@.D.6..ImL....pt...}q......o.?....{..k...?.'.?...;......._.~}.?......i...../.o.G.....?.?......X.?._......_h.........~..b...........K.X......'..._.t..{....o.<..o.....%>e.i.s..............W...^...=o?........?...........}....w...............G..._..'~.?..o...W.?..._.....~...........!..?....#......7....._.......c...... ..9..;.0..S.E6.e.)....z.C...LD.*.ms..b.V..{+....K.5.....kdV..Mq$..d...X....ET.];JA.(....T9...V?L.Wm..R..V.@...0E;O....xt..b.../|..L..!..vt...To.Ol..i.T%.L....D...4.+.i....}..^.t...7..5..C....8!..}......Z....>4..8F 4..!I./r...|.H}.rLp.....1.m...G..d...f..fM.$.s...JH;&.a,.......E....T$"..W.Q..IP(m...X.....U;.6.S.Ui.z..u.......dQ..t.cd...7...u..6?..d#..7{.o.@..... N.J..i.n.4.VR..,X...A.P.}..c..S$9...Q.$i...97..a..+%.K.....0iP[.4x.<;.@..r.8V.@..JN.{H.:....4v.b._..k...A}.'....Q..Ec.,t.b.z.*d.%.L..n.?.FOao..6M.S...U~.....'.xT..+....1fh..j..v....0.......f.l....V...s...Z..>.4....._.Pv.uQ...7.$...O6.Q..

                                                                                                                                                                                      Chrome Cache Entry: 587

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):32120
                                                                                                                                                                                      Entropy (8bit):7.992132365032467
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:SYv1F7EDDJq0L6QatIRJBcRiUP+WbcwgP7VigH6vWk/vOJyje:31dwDA86QatIRJkaWbcwg4gmDCyi
                                                                                                                                                                                      MD5:741F563A1868F2C5C8D778D21B2A381D
                                                                                                                                                                                      SHA1:D27BA4D2E88F979789DE84AC1E7AA8F45B0B6652
                                                                                                                                                                                      SHA-256:09FA8FD5A9D7B00A9475A6C37682A9216235E2249050BBFD1F002283DB93D715
                                                                                                                                                                                      SHA-512:29CEA601D30031EC09C38C6529B4B1204C59D3C89E841436231147DC07F254233F9677CE5C6A4B45E56DA9E72AB0F1BAD04BC62FA0B589432DD0F4D90EBC9877
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/index-banner-1.webp
                                                                                                                                                                                      Preview:RIFFp}..WEBPVP8X..............ALPHM......m.i...j+vR..m.WG....l...c.N.p...f...Z{.9cT#"&@....C..9|..."+ `I.....6...!..(k..Xq8..+....Z....a..>.*....M9t..(......j.....E..{9..f@...[.: .... .p......xw3...<.P.l{.Qs............%..>...=.\.-..g#.'.2.t.0{..h......./...F......y..;.k}.....h.'.s..M..|.p<7^7.....$...Oo]..L...<}Yu...G}.d.\2.._j6.....F.[...j... ...L....U..|....l....Zc............cE;X..n.{c-UBJ...UY....B.....T....A.s.g..).|.h.D....lIE?..!...6....f...(.PT....`EM..7*.A.7\.. .s...L........P.......}7.#D`..q.A..F.f>..$..T.\......E..2....62.%u...QR.d._H8...........t....!.L..3.A.D4..\....H..!,..!.....?....m.&..M..f.L.@..?......3...SKj...!....{./..<.......H....R..a.9..].7-.X.S.......G......'.!B.!....W01.w.H.%..g...?r..2u7-l. .-,.....a..G.b.>].AD.C,.....c......?.......c......?.......c......?.......c......?.......c......?...... .....R....H"...J...`......I.xC..I..J..$.n.A...A._H.".s..V2.%.....K.".t!......r...T...*h##...)Pn...w..O..!...(........0.+.A.7\.4

                                                                                                                                                                                      Chrome Cache Entry: 588

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):74176
                                                                                                                                                                                      Entropy (8bit):7.9956452812069765
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:1536:Gs0Bn7m1EWnnvkinvpFgcEvXdwgGkEHDotAuZnlOHghbh5tBOCYMj:kyVvkGhFgXvXygFQoNtkEh5uCR
                                                                                                                                                                                      MD5:92D639281E9F4208F083A85CA8CEDFC9
                                                                                                                                                                                      SHA1:7F0E13C4BF4EAA97E2964B425D95C639F9C9F244
                                                                                                                                                                                      SHA-256:4CF59358414C932FD436A5720B7C3E5B87E41C2A88C93CF76445374F8E639039
                                                                                                                                                                                      SHA-512:012C2FF6C60C48E847FA9FE0B67531801570612F0682C9D8D39A0FE046E1C4CA6C68B7D90297D7F46B5C0A95BCCA56E562240F8E0CD0D27E96D9061E042398DA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8L.!../..?.M@.d.n3..x.#.....O.....y.?...".{v.[.$)3...~.s3....v.&.H."l.j.$.../.wOuf.[.b...ve~..D..Tu%...~..1...u.][.u.#.~. ...S_...4Ii..V}1..}..a....'.m...........J...km..)IyN.....t.]3G-i.;.G~.....:m.{...1s/$.....x.83c...b.3.}.......Y>..|..9.@@......... .~.E..zp......(.(@J>%]d.9.m..bg_...T2.FV..}8.L...~!O...Ng^..-(H.s..$.tw...."..9o......].....z...{....!....&Y....>.....s..-U..F..MO.3..<..Y.,!../B....!~...My..Um..i. ..&|..sg....Q.W...J..L.A.c.1...moZ.=...."...xx2.....\.'@B&..?..)J....B..........6..B@D...E..X.R...U..R4R<Z..9;.!...B."...:.<..]R.H$`..!.H..!.DB..........zW.I.J.z.)...'.......!...1.njS].....B.G..4.p.T.m..xJ..`....I=.|......f......^....O...K73....K,Q....O}4..r*p..7...P.w.s..!s...Q|..d......y>jw... ......X...9.gN.*...|..Q.v.N~......|.......dI7.Q..w.>d:l,......'.*8.P.X..J.Bz.|xs...)%.w.4..8....f.............n.u.,.s.p..r..S1....I9^..*V..`.,.d+....E{f=.U....JJ..m..e8..j..z\...X....k.../<..S........9.....\.J9.....a..e..... ...K.)

                                                                                                                                                                                      Chrome Cache Entry: 589

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):334
                                                                                                                                                                                      Entropy (8bit):5.230800890568558
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:kRZzRxVvnGlUu6hAJAjWG/QV7lK0RDc+wQRaNw6JpyxZRNlad0:kRZTFGlqf1/A7fRorkbRN20
                                                                                                                                                                                      MD5:667A774BCF9CB2B1D598CCACE1FBB0C2
                                                                                                                                                                                      SHA1:8D11A24BF4C8CE5905FD60A4F71F952B7E24E367
                                                                                                                                                                                      SHA-256:97777544811E7AC700281C26F2B3A613EA082C60466909942C56B203142D8AEB
                                                                                                                                                                                      SHA-512:4B0100F9797AB3A3D3E29B59FAB1B34148735E0A99C09E62B7C286146BA6D0C5B52AFEE37284885FDCC85A3607E0FB68444E59B9D86BD1341177E69979323973
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,CKm2Wb,DRmmld,EEDORb,EFQ78c,ElYdAc,FoxcOd,FuzVxc,GjTCAc,GkRiKb,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,g6aYuf,grWkAb,gychg,hKSk3e,hc6Ubd,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=C7s1K"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("C7s1K");._.pr(_.uEa,class extends _.qr{constructor(a){super(a.ua)}H(){return"C7s1K"}O(){return!0}Ya(){return _.g4}});_.Zq.C7s1K=_.bD;._.w();.}catch(e){_._DumpException(e)}.}).call(this,this.default_PlayStoreUi);.// Google Inc..

                                                                                                                                                                                      Chrome Cache Entry: 590

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (505)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3101
                                                                                                                                                                                      Entropy (8bit):5.510070190789468
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:ZCVhQsIjPEUIitHP11AUj58mzz9HRFE9l:KQXs8tlj5xf9xKP
                                                                                                                                                                                      MD5:2B56F2AECF54445041C8189BFD7BCF28
                                                                                                                                                                                      SHA1:00A831A39B5654C3BA6481BAEF24C9EE2A3CDB47
                                                                                                                                                                                      SHA-256:02C64C09327E8BB76ABA9F28A7A1A0944145A9C0C13ECBBEE294C6992E9A8379
                                                                                                                                                                                      SHA-512:67C7DBEDB3771D6D6B0971FBAF335892E7A041289173F14A37F25F87BC08617E234BA3E69E5552BA53F91430E02EB8431CEF1750748F0AB740BE46E4B92AD08C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".PFAhAf{margin-top:5px;text-align:center}sentinel{}");.this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("Qg1uEb");._.EXc=_.al("fXS6ad");_.FXc=_.al("tb9cac");._.w();._.u("gkYwcd");.._.w();._.es=_.B("zmABtb",[_.ek,_.ck]);._.yGb=function(a){a=a||{};return _.xGb(a.Rda)};_.xGb=function(a){return(0,_.P)('<div class="'+_.T("Fx1lse")+(a?" "+_.T("jy7Abe"):"")+'">'+_.CDb()+"</div>")};._.u("zmABtb");.var zGb;zGb=class{constructor({Gd:a,o6:b,Si:c,Qx:d,Wk:e,Mm:f,Ao:g,zq:h}){this.ma=a;this.O=b;this.va=c;this.La=d||c;this.H=e;this.Ma=f;this.Fa=g;this.Aa=h}W(){return!!this.H&&!!this.H.gp()}oa(){if(!this.W())return _.Xf("No data to return.");this.La.append(this.O);return this.ma.fetch(this.Fa(this.H)).then(a=>{this.H=this.Ma(a);return this.Aa(a)}).then(a=>{this.O.remove();a.JA(this.va)}).Uc(a=>{const b=this.H;this.H=null;this.O.remove();throw Error("ze`"+b+"`"+a);})}};._.tV=function(a,{Si:b,Qx:c,Wk:d,Mm:e,Ao:f,zq:g}){return new zGb

                                                                                                                                                                                      Chrome Cache Entry: 591

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5999
                                                                                                                                                                                      Entropy (8bit):7.95383618747212
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:KdBtAqjYobskN2nKL9RqYuY13OpsoiPcuf5U0mC3zEDaUFFtUORBtLw+:yBtAqcjznKqzSOhLuhU/C3zhqFRS+
                                                                                                                                                                                      MD5:5D67F6E71E8A8AF611FEA2B628B5F2B9
                                                                                                                                                                                      SHA1:F4D2FFAFA281ACC1C22A2702C14DB0B58307CAE3
                                                                                                                                                                                      SHA-256:37E7502CCE44E4E377A9BB44E4D87674C1F0A9AF91455F9DC18AFFCDB13228B2
                                                                                                                                                                                      SHA-512:0F03606A1DEF0E57094FB3BD3DF02DABE305752D4702F38C7E535D6E5AE8A4AAA090C51A49245D6B83381FFBBF2F38D25DCEEF67D3BB018DD38C067E0D562D8C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD.............$IDATx..];...q....}PK...D.........d.V.M..i......R$A..)R... E.T)R.)..J..Ia.!..."...&-H...M..EI.{...8..9.R.r.e.....>......7...4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i......g....a*.....k..E...R"..t......C.5._%.Y.........2..?\{..^~....."J.E....^..3..`..7.l..pO.c....._..+W....D."...;{....p..My.)...o<../=9}.....`.u.......ls~...........l..p..:...|<...Gp...*'".e.'F.F..B.....q..k..%|'.o..+.....sv..0...qX..X......w..=.....o..}|.@.....@.*..2../ln=.....p....N.$7.`...+.0W.x.._.N#..c..ES4..@(...I....=...@..W/.q~..8...R.........>...... .....I..M..`...JcLf.P.>b)..<.\...........~....3u.Y.@y$.W.@Y.c{.a..zwa.@.)Qw/Riv%x...r.....(.'..2{..*.....Pb."1...9..,.G..m(......=..'..?..."*./R..Q ..O...=.9...,9...>^J.....c.%..Y.}...d.....d.|....c!b......d.....S...$2..,...SAs).c.}%}+Z..t@..o`.E".......,...l...S....(@...b)..,.h..|.ZP.&.*....eA...8..L..zD..H.FY.....'.1M>.w..B$F6B1..6.....U......zV.qdnM.Y(.ne...

                                                                                                                                                                                      Chrome Cache Entry: 592

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 648x364, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):42596
                                                                                                                                                                                      Entropy (8bit):7.994665436618845
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:4ORLOCDiv0fVngq+HtUJFr0uiUBqSE3FaPu5XASgV48fCGFU/yzRkuEfXB:4Oxte0Nng/0r1iU8SokPwAV/KGFU6ux
                                                                                                                                                                                      MD5:09304D8D7AB54176EBB3CA49BF973579
                                                                                                                                                                                      SHA1:EC09BE86A1F5EDC0B8FE16B0A5097E4888489D16
                                                                                                                                                                                      SHA-256:7F670EB338301953E8B4344C3842C5BDE4EEB9221A1C969D74F8A60F052AC324
                                                                                                                                                                                      SHA-512:2288BA387918C4D72641C46D3E57CB03722B317689F10CC5C8A7D18B06A3F2151CA6867E622957ADB6C22FB2D58D320657E17ADB9B8E2CEE284D54E8D2C925B2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/PBqTyIWxz8XUlc5UfaWjMoeUsVMMWmdlytLt7PANGrcDh8vK12i1qVwb4nMQFVgXy3Gf=w648-h364-rw
                                                                                                                                                                                      Preview:RIFF\...WEBPVP8 P...pj...*..l.>U$.E..!..648.D.6..9.N.....n.........|.._.g...i../.....~............S...O..._..x........z..b.[......{.c......W......#..?.=.?..f.....?...........7...Nw..o......O..._.z.~c.{...H..W.../.>...G...>._......l}[.+.W..........{...o...~....t...7.k...._....?.Y...=...\D.(3.XZH...)%..V@.....p........b..Z.9....b{?.a...@.J.T....y.K.W&~....D..{....l...{....R.;.z.wD..6D_1h8.....j...fM....AC......~...k~q...(~.....&...lS..@........}...f..;..m...h..!w..\..j.o3....Xt#{..b6@`6r...B).;...=6|T..pm..q.V.._....k<..<....\...xh.:;...*....y.,b.... :...eX....[..wH6m....6 K....y..|X....S.46.s.._.l.<;.....O......:...:.S.T...b.t....8[6a../..c..$..9..7.>..c:.J...9...-%...@.5d..k.8...AK..h{...8.q`\BZ.$...sJ..$.0.F.!1.b.o...1..h.G...}^..S....t/..;*=..Q.F...4'...di.(1Y.%..f..n...I..!..d..E..<.1X%.+...5...Z.'.2J....J.4..".."..4.;..a.4. :A.......2...u/..dC..Y6.n.l.h....LF.E.b\+..|.k1...<:kD..Be...+........W1.S.,.H..?....K.....ykTwZ..j*u..5...B=.8(..

                                                                                                                                                                                      Chrome Cache Entry: 593

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (28115)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1134323
                                                                                                                                                                                      Entropy (8bit):5.702482149471141
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:2soLRr3euhPtuAOOic7ebbFJrGE8qLOIZZ0VLzBD/0X652tyvQn9l2EvqauHVr/4:2soLRr3euhPtuAOOic7ebbFJrGE8qLOm
                                                                                                                                                                                      MD5:E0EF20C0596DDD4F6221D25FABD0474F
                                                                                                                                                                                      SHA1:51200F20A2FBF17374A279AA3248EAF40A7CC9FE
                                                                                                                                                                                      SHA-256:FB783AFE1433442C486419596B4FD56847D698A7B68240DE83CAB33E025C841E
                                                                                                                                                                                      SHA-512:A0E2241C0BD10DB59260D3677961C971624D69A63ABC449CFD06452F5333B84A20D63C15855B3BF8824C16CB6E249196024634623F8F5C3D9E68BF899121F0AB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=JWUKXe,LEikZe,_b,_tp,byfTOb,lsjVmc,t1sulf/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=ws9Tlc,n73qwf,GkRiKb,e5qFLc,IZT63,UUJqVe,O1Gjze,xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,ZwDk9d,V3dDOb,WO9ee,mI3LFb,m9oV,z5Gxfe,ArluEf,IcVnM,fl2Zj,vrGZEc,wW2D8b,j9sf1,LCkxpb,kr6Nlf,O6y8ed,PrPYRd,MpJwZc,NwH0H,OmgaI,lazG7b,XVMNvd,L1AAkb,KUM7Z,Mlhmy,pYCIec,s39S4,lwddkf,gychg,w9hDv,EEDORb,RMhBfe,SdcwHb,aW3pY,pw70Gc,EFQ78c,Ulmmrd,ZfAoz,mdR7q,xQtZb,JNoxi,kWgXee,MI6k7c,kjKdXe,BVgquf,QIhFr,ovKuLd,hKSk3e,yDVVkb,hc6Ubd,SpsfSb,ebZ3mb,Z5uLle,BBI74,ZDZcre,MdUzUe,A7fCU,zbML3c,zr1jrb,Uas9Hd,pjICDe"
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".EDId0c{position:relative}.nhh4Ic{position:absolute;left:0;right:0;top:0;z-index:1;pointer-events:none}.nhh4Ic[data-state=snapping],.nhh4Ic[data-state=cancelled]{transition:transform 200ms}.MGUFnf{display:block;width:28px;height:28px;padding:15px;margin:0 auto;transform:scale(0.7);background-color:#fafafa;border:1px solid #e0e0e0;border-radius:50%;box-shadow:0 2px 2px 0 rgba(0,0,0,.2);transition:opacity 400ms}.nhh4Ic[data-state=resting] .MGUFnf,.nhh4Ic[data-state=cooldown] .MGUFnf{transform:scale(0);transition:transform 150ms}.nhh4Ic .LLCa0e{stroke-width:3.6px;transform:translateZ(1px)}.nhh4Ic[data-past-threshold=false] .LLCa0e{opacity:.3}.rOhAxb{fill:#4285f4;stroke:#4285f4}.A6UUqe{display:none;stroke-width:3px;width:28px;height:28px}.tbcVO{width:28px;height:28px}.bQ7oke{position:absolute;width:0;height:0;overflow:hidden}.A6UUqe.qs41qe{animation-name:quantumWizSpinnerRotate;animation-duration:1568.63ms;animation-iteration-count:infinite;animation-timing-func

                                                                                                                                                                                      Chrome Cache Entry: 594

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (2343)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):52916
                                                                                                                                                                                      Entropy (8bit):5.51283890397623
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
                                                                                                                                                                                      MD5:575B5480531DA4D14E7453E2016FE0BC
                                                                                                                                                                                      SHA1:E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
                                                                                                                                                                                      SHA-256:DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
                                                                                                                                                                                      SHA-512:174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.google-analytics.com/analytics.js
                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var n=this||self,p=function(a,b){a=a.split(".");var c=n;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r||u();v=v||q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING||[];w.TAGGING[a]=!0};var ba=Array.isArray,c

                                                                                                                                                                                      Chrome Cache Entry: 595

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):5999
                                                                                                                                                                                      Entropy (8bit):7.95383618747212
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:KdBtAqjYobskN2nKL9RqYuY13OpsoiPcuf5U0mC3zEDaUFFtUORBtLw+:yBtAqcjznKqzSOhLuhU/C3zhqFRS+
                                                                                                                                                                                      MD5:5D67F6E71E8A8AF611FEA2B628B5F2B9
                                                                                                                                                                                      SHA1:F4D2FFAFA281ACC1C22A2702C14DB0B58307CAE3
                                                                                                                                                                                      SHA-256:37E7502CCE44E4E377A9BB44E4D87674C1F0A9AF91455F9DC18AFFCDB13228B2
                                                                                                                                                                                      SHA-512:0F03606A1DEF0E57094FB3BD3DF02DABE305752D4702F38C7E535D6E5AE8A4AAA090C51A49245D6B83381FFBBF2F38D25DCEEF67D3BB018DD38C067E0D562D8C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/windows.png
                                                                                                                                                                                      Preview:.PNG........IHDR..............F.....bKGD.............$IDATx..];...q....}PK...D.........d.V.M..i......R$A..)R... E.T)R.)..J..Ia.!..."...&-H...M..EI.{...8..9.R.r.e.....>......7...4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i.I.&M.4i......g....a*.....k..E...R"..t......C.5._%.Y.........2..?\{..^~....."J.E....^..3..`..7.l..pO.c....._..+W....D."...;{....p..My.)...o<../=9}.....`.u.......ls~...........l..p..:...|<...Gp...*'".e.'F.F..B.....q..k..%|'.o..+.....sv..0...qX..X......w..=.....o..}|.@.....@.*..2../ln=.....p....N.$7.`...+.0W.x.._.N#..c..ES4..@(...I....=...@..W/.q~..8...R.........>...... .....I..M..`...JcLf.P.>b)..<.\...........~....3u.Y.@y$.W.@Y.c{.a..zwa.@.)Qw/Riv%x...r.....(.'..2{..*.....Pb."1...9..,.G..m(......=..'..?..."*./R..Q ..O...=.9...,9...>^J.....c.%..Y.}...d.....d.|....c!b......d.....S...$2..,...SAs).c.}%}+Z..t@..o`.E".......,...l...S....(@...b)..,.h..|.ZP.&.*....eA...8..L..zD..H.FY.....'.1M>.w..B$F6B1..6.....U......zV.qdnM.Y(.ne...

                                                                                                                                                                                      Chrome Cache Entry: 596

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):15552
                                                                                                                                                                                      Entropy (8bit):7.983966851275127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
                                                                                                                                                                                      MD5:285467176F7FE6BB6A9C6873B3DAD2CC
                                                                                                                                                                                      SHA1:EA04E4FF5142DDD69307C183DEF721A160E0A64E
                                                                                                                                                                                      SHA-256:5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
                                                                                                                                                                                      SHA-512:5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
                                                                                                                                                                                      Preview:wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v.*.7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....|...H....Fk.*-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..|..d...|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

                                                                                                                                                                                      Chrome Cache Entry: 597

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):38212
                                                                                                                                                                                      Entropy (8bit):7.993997570128572
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:QB80RJjSBRg8+aPUNJroK5d+rF8hooqnGdAjkyJb01PFj1s:QB8wqGPpPrpo8hooqGcJbWY
                                                                                                                                                                                      MD5:83AC4CAE8240E1782435213A15B04A1C
                                                                                                                                                                                      SHA1:0A3499F2FC4D410A0B945F77380A76078511D4EE
                                                                                                                                                                                      SHA-256:986500DA5D603A6BAA9E89BE92EBB023231B9B2CDB305D567F715FF1A26FD94B
                                                                                                                                                                                      SHA-512:CF22A837F51964B35F07121E92AA8A5540B67B0F880C7A4EBC1F571F01EDAC950E8D59FB0AB02A0396183753372A4C352589776BB1F3848B3889DA9050419A28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/8MjlA1H2Oudc0DLcKzrrZZ-qjAACuANGQlgFtaHVEmx2YYBB1FoGGVPrddoFKa8N=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF<...WEBPVP8 0........*..(.>e(.E."....<.p..fm..+..?.VW....w.~..I./Z..............._..w.......V..........?.O...O...............w._eO.?......L.}.#...s......_k......=...t;.......?....]..k..z....'.............O.~z.......o......P..^.........]....../...........O......;.........../....~.}D.........ot.Y...U...........?...~....}.y....K....'.f..~.|.Q...8...rM..Nz..e...e#JJ...i..Eu.`.v..1.....P-..1>5.|...+...$.<W..F.`.'..T......%.....9...)Ry.c<DlD..3.....~.j.....~.z.l......`.Y......ii.Ot...........v..G....."W.p...........r...jA..........8...G......<..O.#7....G..w.....G.=..".+....r.C..5..+.......E.U0.......6{#+.....M..3^k.w.;|.z.....c.<..z.y.........=......O.;/...".\3 ..A..F9.M.c..(3..#.U..5.....i...].3W,..p.xx....>6.[.....q..:)T.f%x.^....V..^mm .}.V)..l.kb.]...@"...'....D.5....o....B.Y.......uu...A/..9:({.(.c.,..C..,.G!.$~=...m\.k...h.O........*.Y...6Zo".^..Sz;.D..r.....z....3M...&.N&8......#{...u.rs..^......()V.G.........0..C.n..e.....'u

                                                                                                                                                                                      Chrome Cache Entry: 598

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3866)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):19130
                                                                                                                                                                                      Entropy (8bit):5.429312887800645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:FfdMN9U396cXU+259cL2YQJ2c7q0bI2z9T01PIAM9b3YeV26HTnPzfQf:x396cXU+2Tc3Q8c7q52z9o1PIAM9b3Yf
                                                                                                                                                                                      MD5:F0CE7653EABD44ACAAF5C7F04EB432F7
                                                                                                                                                                                      SHA1:7845DA90B09EC0567576DF3D369BD97FEB3869D8
                                                                                                                                                                                      SHA-256:04B6C36A889187DA8F0335539D66D0684C1AA13DF5F627F0C2A4871463B31968
                                                                                                                                                                                      SHA-512:8776FF504B5099F2EA6AEE3279DE919252ACDE91DB9F3AD8149EAD4711D3EE2D8E4506AD8F683E733B9B14F54E263D7D7CE33EE6374ADD612D6FB7DE0B0AAF3D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.$K=class{constructor(a,b,c){this.key=a;this.defaultValue=b;this.flagName=c}ctor(a){return typeof a==="boolean"?a:this.defaultValue}};._.u("RqjULd");.var Obb=function(){return Nbb??(Nbb=Object.freeze({je:a=>_.wd("iCzhFc").H(!1)||a===-1,environment:_.fi(_.wd("y2FhP"))??void 0,vda:_.fi(_.wd("MUE6Ne"))??void 0,Zq:_.fi(_.wd("cfb2h"))??void 0,Ml:_.gi(_.wd("yFnxrf"),-1),jZ:_.Nq(_.wd("fPDxwd")).map(a=>_.gi(a,0)).filter(a=>a>0)}))},Qbb=function(a){if(_.aa&&_.aa.performance&&_.aa.performance.memory){var b=_.aa.performance.memory;if(b){const c=new Pbb;isNaN(b.jsHeapSizeLimit)||_.Eh(c,1,Math.round(b.jsHeapSizeLimit).toString());isNaN(b.totalJSHeapSize)||._.Eh(c,2,Math.round(b.totalJSHeapSize).toString());isNaN(b.usedJSHeapSize)||_.Eh(c,3,Math.round(b.usedJSHeapSize).toString());_.G(a,Pbb,1,c)}}},Ubb=function(a){if(Rbb()){var b=performance.getEntriesByType("navigation");if(b&&b.length){var c=new

                                                                                                                                                                                      Chrome Cache Entry: 599

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):20504
                                                                                                                                                                                      Entropy (8bit):7.944781615549727
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:m9m0Ya2WVOAt2z3qfnLq40sfvvKRvuq3qjogJo0xBUiVirZ4FCN789:m40cX02+fG4RKc8GogDx6N4EC9
                                                                                                                                                                                      MD5:8ACBA1B03533A3D4B0482B3C6193370F
                                                                                                                                                                                      SHA1:2CD76243AB1AF281CF9768E2875C1DE9BA3FFB10
                                                                                                                                                                                      SHA-256:347D1E941D911C7083F13D8192D5B56DD64E09E043FF3761777D44F973F7C588
                                                                                                                                                                                      SHA-512:9F67465AF49CD4B7EBE37D6110C860054B9F34E64FCB1D198D5BDEA2E15D65F8C4F37C559E38FDE486B5C72EB6EDA25CFB0ED465BFEC20C18DFA1D434F25B4F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/47X6RUlrjixHTXXreHvfQC2WGN85lG9-Ih8Y8ushUoDuKk-NA-0If_GlRAAGcRi6dIw=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF.P..WEBPVP8X...........'..VP8L.O../..I.M8l.. .l.3...7|j .....+S.$.....W,;....L2sc@.....wB...Q.&:..v..~'AtQ4..BrN.>.0.x.c.w6.........7^*=Mz..7.B.4u..s..Q.1...D......u.P..]5B]..'n$.$+o....S..N.....b"!..H!.^.pk[R......`a.k).H6.1{]%..I.m...<9A..C|.E1.Z.N3-...H.$..G...q5.{.e..............jm.L<-_.n0S....n\...\.g...z....r...^z.b.fNW....:*~.fN3..i......#...............>^.x...V.CR.@D...P.DD@.Y.F..1.....Mjs%F.SN..57.;.#.b7.{'.$W....+.\f.....'..&v..d..W..$....'..5:.{....kOlg..l.6[Y.l.f.4.|..M.s|b..$.-Z.|.....J....U..".""1... "."A$.@t .h..D....3XD...XDp......AD.X.5.5. b.aW. .Q.........l1`.......!.....D$......k.8..H...".|........hXDD.%.....$...O.I;.="&.....8t.B..T.....:a1....$...M..Z:..7.H"..:...>..'w.h....M...:R...O.m.r4.V..L.sDlff.s..g.BL2...3...f+...d....I.#Y.=O!y..I...d'.F.$I.......Sy.....$IV...0...x..e.V.h.1.Z.bK%Yfv...w..}.[.T\FYV.mK2.2s..aH..u..$.Vm.-3/./f.._....!.1...$I.m[.$$..j.V...?:ki...`...sg.w...`k;$I...FU..6.f.m.m...;F.m[....."...%

                                                                                                                                                                                      Chrome Cache Entry: 600

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1752
                                                                                                                                                                                      Entropy (8bit):7.853145468821245
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:SMX8/F5KiZN4DBY68Fp3OsGlm4EupVgzGaQ:SS8NlKY73OplmoAKH
                                                                                                                                                                                      MD5:DEE02D2182FDDBC660873A3E9CDBB96F
                                                                                                                                                                                      SHA1:3A92676F51038E0450AB8DDC39DE965106A2B702
                                                                                                                                                                                      SHA-256:B13FB45F8B5858F1B529B347E6F605D4513361D3B9F60BDEC00DE4E7B685AB9E
                                                                                                                                                                                      SHA-512:294E263A97E858AB69ED35D09B232DCBB40EB73C03F356B0469478CBC04DD2B4DE96E7B6675F361156390E7A65D68CF1F417A3EDD9C1C538DB09B1AAAB784C2A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/RvoqjE2iVJqKC1TzU5QjMMR7GsX9zrRxr-0fZiKo_F67LVFj-8yt58Ms7NpSfPmvcO4=s64-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........?..?..VP8 ....P....*@.@.>i(.F.".!9.MP...b.....!c.+..).+.w..Y.._.~..pZ.w..]....6.....~.o@.....#./6.X{.yg{....{..w..2<.E....=.4W..x../v?B*Hs7.b"..r..z.F.Ro.`zX.....!..u%.`...0./=F..a44$...v`.A....... ..\.`Ri.b........*N...j.Z.*....A4N=...u.................,...>.L.!.{...R.....$..6~..\....p...nF.......+....0.g<...\....q...M_\....{%..Vn.%..a..k.'.k..y.....e".].O..sQ.....f[...2...].2.4#Q..[....>....[q....0.[..4.`v..'..J..".}I|jS&....e..B.A_."U?.Z..Lk.zl]..~I.7Z"9rw..:.3M......{f.r..AD..3TG.....N.@.wG.....-..`@.3...:<.M.4...UH_A.......q..2...}.mm....H.Gp..+.'.&..X7&....G..6....;vXY*...V..b.D||...........].. H.=.SA.=^4.g.w..W.=G..y9.......f....-wf..AY....._...3...M...&.6......T..f.T].....JD..?Y.QE....Q.R:".l.+.Z...!I....Y.......).g..7@.v..|........'.yX....c...02.E.(.9...\.~.....e..~EV..c.y...ji.I$faU..(^G>Lz$...s...4Q.&0. .L...M9..l...u ...b]..B..Y....hu..Y..8 ......|;..."...P._..........A......T........)4._ndG...h:ep..>...UW..

                                                                                                                                                                                      Chrome Cache Entry: 601

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21094
                                                                                                                                                                                      Entropy (8bit):7.9920522935726535
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:384:/iFK2kFvXXGJ+vr7UQ3JxqeL607pSqlTGkxUT1UosSKIldhKUvlImyBnL5CUk:6Y/GojwQrZZSqtnsw07MclIm0nlRk
                                                                                                                                                                                      MD5:651BC28C7E597E841D6AF7C6DF10ECC2
                                                                                                                                                                                      SHA1:8F4E7310E65BFFF075F6B722AFC6926CAC7EC879
                                                                                                                                                                                      SHA-256:087606CF594EC3375F3A6E70C517DDD2E7A6A2D98E40FC5A78A1EF96AF8F7AB6
                                                                                                                                                                                      SHA-512:98D25B7968DBAF272C83A8D3432B61D520565D15038AF3B23AD1C669A9F0D9A3775567E0D91C4235D32D01A67846C1FA1698521EC496F3C2D0EFE816F6998353
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF^R..WEBPVP8 RR...B...*.. .>.D.K%.."..z....in....!...@.P..~.?.1......Vw.....y..7..P.`.1..>.?b.@~...z@{........?.7.o`.A.6.......zX.....g................7..._.....=....C.....5.W......C./..o..x7....A.'.k.../.........?....%.........j........d.e.....O...O..?.................W...?....?.?......[...'..._...?C.-................O...........>..k.....&|;....LH.2bEA..*...Pd..&$T.1"....LH.2bEA..*...Pd..&$T.1".....-.....;!...'..&Rm..@.F..v>.*l.....j..a.$I...I.3v^$T.1!.:.....x=..E.e..o.!w.~........uL!.B1.(&.....;.H.s..W_.CM.CH5...x.2.Qm.+.'Z+f..B........'H<ag....Mj!.....L........W.}...m.e.QPd..&$T.1"....LH.2Dq{\...C.1....~$...L.+.F..._..|.)B<..n....f}...w.^/....R..o .qDqC..._....w....`%..v..@..f.....CT.{.-_...j.:.6._..~.\t....4.2o.u.....m.u.E...._.v. F..~.~^.&$T.1"....LH.2bEA..*...Pd..&$T.1".....e~U.....x.MB......N....6-4.v....Y.H.....f.\.36....d.|.. R..o..d..4(..........YL........P..l...A.E|(5..tjc....r....y=....p..C..BV..=6O.......7'.R.W.....tB.A.aG

                                                                                                                                                                                      Chrome Cache Entry: 602

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (3034), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3064
                                                                                                                                                                                      Entropy (8bit):5.4268052346910025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0E54uBXNdAwhrQWgmMDgHoxphyhBHKYfxADAWLSHukLlLqEV:0TudTSgwM/n33V
                                                                                                                                                                                      MD5:62E10CB6AC535EF6143B72676A0D896D
                                                                                                                                                                                      SHA1:A7492B4C7A30B6BCEF4388DBB14D946779479B49
                                                                                                                                                                                      SHA-256:E73DC7F61E37E47FBDF5E22A1AEA6538E61C87BB06B0B8041AD582BA04363828
                                                                                                                                                                                      SHA-512:3DE5CE6A3DCEC6A5D50BAA5F2CF1C6BC463A9A9A903814135D1BB7D4D275B4CA68C6C9FF07C443E5A41E6216B680ABD0BBCE36A51CA1510D6CB20B2A2DF6FD30
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/flexible.js
                                                                                                                                                                                      Preview:!function(){var a="@charset \"utf-8\";html{color:#000;background:#fff;overflow-y:scroll;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}html *{outline:0;-webkit-text-size-adjust:none;-webkit-tap-highlight-color:rgba(0,0,0,0)}html,body{font-family:sans-serif}body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,code,form,fieldset,legend,input,textarea,p,blockquote,th,td,hr,button,article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{margin:0;padding:0}input,select,textarea{font-size:100%}table{border-collapse:collapse;border-spacing:0}fieldset,img{border:0}abbr,acronym{border:0;font-variant:normal}del{text-decoration:line-through}address,caption,cite,code,dfn,em,th,var{font-style:normal;font-weight:500}ol,ul{list-style:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-size:100%;font-weight:500}q:before,q:after{content:''}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}a:hover{text-decoration:un

                                                                                                                                                                                      Chrome Cache Entry: 603

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):15344
                                                                                                                                                                                      Entropy (8bit):7.984625225844861
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
                                                                                                                                                                                      MD5:5D4AEB4E5F5EF754E307D7FFAEF688BD
                                                                                                                                                                                      SHA1:06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
                                                                                                                                                                                      SHA-256:3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
                                                                                                                                                                                      SHA-512:7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
                                                                                                                                                                                      Preview:wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h|.l....A....b6........(......@e.]...*:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#*e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.*UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...*$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf*.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed.*.'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

                                                                                                                                                                                      Chrome Cache Entry: 604

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 648x364, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):47592
                                                                                                                                                                                      Entropy (8bit):7.995695478540073
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:yPDiPfiV20xMI5s12KDG6BXOInhExGBomjZDfEUpfCOSlbZph7/Ym/V:yR2EY2ve/nhY+9fEUpfriph7/Yc
                                                                                                                                                                                      MD5:83011E0EF74A5BDE0D7A6F8D6539BCCA
                                                                                                                                                                                      SHA1:FB591798ECD82814DF2AF04AE25BBE9D1BA9378B
                                                                                                                                                                                      SHA-256:CBC16BB5D44E91AB8C95783D4BA9691500E542D9538E0B1C3A43D9A550CDA557
                                                                                                                                                                                      SHA-512:0B91166480B47F0D12BFCBC2838D842E670BB29CDD06DAE2FBF6452785D5D4F4DE2EE92C7889D488C6EC68208582FA23D2E01642D8F97DD38F091F0832B97CAE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ........*..l.>](.F#.!..4....fkj....J...,...........F.=..._w.;.;..|...u.?...|....q...7./a?...V.......K........x......?......[.{.....{.S.;...O........}.............._.|.|..o......w..._.f_.?..?.........'..:5......oU...+.=.......R.......;..W}o.....G............../.?..m>...........c..O....z....Ro.<.....5..G......'.i....UD... ..."..CFe.}c6..Wm(.1gcAl/. 2...j.4Rq.....=...mD$L9w_]#.....K...j......)G.g..h......j..@].u].M...h..........[...C..9.....-...x.......Y....O..}.S.CY:v.!.Q%..w...G'..*..xo..z9.&..r...U'.....u...k..!.VY.v.....rt....!.Z,...3D.......6.]O..:..{.X.].,Tq...{a....3...{..Q_Z.......)..@.0...M...b..C....,...8q|.k.t.@.`.A=O...M.v.{...P...z.....&FR...$...s../...Ed..:..6[.#...6:".P...9......e]lker~.1.+.@..Bsx.r..N..z.....o.8.G.k.72.+.t.v..[...%vs.C..r./]S...4.p...P...H.e...$P.<NHq.E.k......g]...9.JQ....40..8.&...q_....)5..l..;...=..:................u=L!.S4..#..6p.....P........X.t..D..c.......R..p....0G(\3c.aNl........eRl..f

                                                                                                                                                                                      Chrome Cache Entry: 605

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (17998)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):18618
                                                                                                                                                                                      Entropy (8bit):5.640300193320173
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:MolxP/aWS4dj4lfFVqEBSmur4+O5Un8OxuTtLRsFOuohfa8wnaeDg3z6MVRegEW9:DlMWSKcKDOhtLCONa8qae0rVReZWrPJ
                                                                                                                                                                                      MD5:59D00FA56FB8B29068D96A431A52AE7B
                                                                                                                                                                                      SHA1:9F8C5455383C49873A60CAEBACB1DECAAE0F909E
                                                                                                                                                                                      SHA-256:76E6DCC56BA185BAB0F2E68B485146BC42E79395A67DF0F7C23A18790677DE09
                                                                                                                                                                                      SHA-512:3BFF8DCB6FDF2B4DE78211D636AE0310891FE6653CD1C6CADE0AE8039AC0EB67659DA142040B6290133E0D928FA1D22061F0A043D86F232AD40527A80B30F7EE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.google.com/js/bg/dubcxWuhhbqw8uaLSFFGvELnk5WmffD3wjoYeQZ33gk.js
                                                                                                                                                                                      Preview:/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var c=this||self,C=function(d){return d},m=function(d,a){if(!(a=(d=null,c).trustedTypes,a)||!a.createPolicy)return d;try{d=a.createPolicy("bg",{createHTML:C,createScript:C,createScriptURL:C})}catch(f){c.console&&c.console.error(f.message)}return d};(0,eval)(function(d,a){return(a=m())&&d.eval(a.createScript("1"))===1?function(f){return a.createScript(f)}:function(f){return""+f}}(c)(Array(Math.random()*7824|0).join("\n")+['(function(){/*',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'*/',.'var dB=function(d,a,C){if(d.length==3){for(C=0;C<3;C++)a[C]+=d[C];for(C=(d=[13,8,13,12,16,5,3,10,15],0);C<9;C++)a[3](a,C%3,d[C])}},a2=function(d,a,C){return d.PE(function(m){C=m},false,a),C},cb=function(d,a,C,m,c,Z,e,F){return(F=X[(Z=(a=[27,-7,-92,-77,46,39,a,14,55,37],d&(e=f$,7)),m).V](m.uZ),F[m.V]=function(f){Z+=6+7*d,c=f,Z&=7},F).concat=function(f){return((c=(f=(f=C%16+1,+a

                                                                                                                                                                                      Chrome Cache Entry: 606

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (13630), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):13630
                                                                                                                                                                                      Entropy (8bit):4.928035145657772
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:eMnFbqzkvz93Rn+KDSuqmIh2yM2B+61bE9+E5Z3Ti:fF+EBn+KDSuq2yfk8bE9+E5ZDi
                                                                                                                                                                                      MD5:4A093B6B9C295191A283047E931A5952
                                                                                                                                                                                      SHA1:0199C76E37A109CB3385915BE2231EA730CC97F7
                                                                                                                                                                                      SHA-256:F46C5CEB5695D2724088AA9305E615CF698F7F61C9F9B02D1B41C4584280E1BD
                                                                                                                                                                                      SHA-512:6A56AE9892F0940ECF15FBD6B6C8C4459762CC70B5068AF5C6FF0EE94D0E49AED871DB295D0E5D7CAB4E879BC1CF6E515E43E9514FF5AA49B685529836DC7C2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/css/home/download-new.min.css
                                                                                                                                                                                      Preview:.clearfix:after{height:0;content:".";display:block;visibility:hidden;clear:both;overflow:hidden}body{background:#fff}p,span{margin:0;padding:0}img{display:block;border:0}.container{margin-top:50px;width:100%;background:#fff;padding-bottom:50px}.container-full{width:1200px;margin:0 auto;padding-top:100px}.container-full .left-bar{float:left;width:320px;box-sizing:border-box;padding:0 30px}.container-full .left-bar .download-icon{padding-bottom:50px}.container-full .left-bar .logo-icon{width:120px;height:120px;margin:0 auto 30px}.container-full .left-bar .logo-icon img{display:block;width:100%}.container-full .left-bar .download-link{display:block;width:100%;margin:0 auto}.container-full .left-bar .download-link-btn{display:block;width:100%;padding:15px 0;text-align:center;font-size:16px;font-weight:600;color:#fff;background-color:#0090fa;border-radius:4px;transition:all .2s ease-in-out}.container-full .left-bar .download-link-btn:hover{transform:translate3d(0,-3px,0)}.container-full .le

                                                                                                                                                                                      Chrome Cache Entry: 607

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):40692
                                                                                                                                                                                      Entropy (8bit):7.995022526542713
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:slf3K5qlwBM1bCgq/s31UfnLjvNNYhqRhEZGrK5add:6FcWbCgCscGqRh+GrKwd
                                                                                                                                                                                      MD5:97952ED4B06D4891FECE3D3C842062B6
                                                                                                                                                                                      SHA1:CFE809DEF314F3D3569FD24ABA48F00001678684
                                                                                                                                                                                      SHA-256:DBEC46F7F8D5F6A8C9F734ACEF8AC317D05270AA26174E2B875EB44A804C10D5
                                                                                                                                                                                      SHA-512:D40E0038A3F3DE00D59DAD8BC46FB400A2EE167E34EEF577EDD0AFE5A746837D7347EE4D2FA99A25BE60955E2C79FCC7CE9AB05AE0AF1F7D666CFB36EAE3786C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ....0....*..(.>m*.E."..;vL@..6.\...2.{.l...W.,..............e...>'.....g./.O.w........e.T......./...o..x....^............/.K...W...?....q=d.....1.u..........._....1..._.?.xK.........G.....}........3.w...?.y#.....>....S.c...../.{.x......}.._._......................g...|6?%.....W..............B......._.r...........g.......m.........+...G.......o7...Eo..h._.?J..-..%.4..Q*.;Y...Wgg.6.f..4Zu$....t.."..Rnsp.}....~..2.&....tF^2.).?6%..g.....7...D...j.g..G.....h..E..X.+....*'\.....}..&...D1..\.*....\..L.....5o>..u..V.....i{.^.........u...)B...!.hI'@M .]......{..uy..z'..3.{...E.u Y.].....=...[..GP.(.E..=.....32`7...V,.K..;..7.^!$PoXv.......K>....p.(......P?O.:..........r..8B0.0.o.pi..t.H.N.H..TX .9|......';[Wv.V...;....SRV~........m.....W..j.L1...&t.f.8..i.w.'.|.@....-......Xza,....3s.4..ykw..5.&.J.%.......(..qt..d....P.....[.vgX.#.2.....Hk.{...[...W=-.j.A.Y..'.q]..i.....u....sb.0...g.S.2-#..".+l.Ku\.VB.D.qb.E.2...@96.v.4.OQ...

                                                                                                                                                                                      Chrome Cache Entry: 608

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1527
                                                                                                                                                                                      Entropy (8bit):7.052183572825318
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:F1hmYaWwjx82lY2T3QvVwqyJ3VI6BGYA2wVE/ThRLg2In0OPrnq3BQxDn2/9kb:rMYLNn2Mv8J3T/ANVEPLcnjPrnj2ab
                                                                                                                                                                                      MD5:27CFA369283BAA8A6339815EC2728FB0
                                                                                                                                                                                      SHA1:B7FECA078CE0F57384843109704054B19545C2D7
                                                                                                                                                                                      SHA-256:1CAAD2497915F2A5CE0640CE769EB883A942A25652A5AD3E69C077885A4D3894
                                                                                                                                                                                      SHA-512:E3A19C1B2158D62177A0A11C3D4922384A23CEFE594A97EE82A9634E2AF8A21BBF11D2862C369B2588414C34E8C78E2A3C26D03C218748C087715ECFFF4805BA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/download-more-icon1.png
                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:3C280707A22411EABE3FA987F0B8798B" xmpMM:DocumentID="xmp.did:3C280708A22411EABE3FA987F0B8798B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3C280705A22411EABE3FA987F0B8798B" stRef:documentID="xmp.did:3C280706A22411EABE3FA987F0B8798B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......eIDATx..Y.K.A.vk.2....PR.Y......k.).t..(.... A..t..n..V.A...u...F...7....w]..5..3..}.....9Q...,=...F.

                                                                                                                                                                                      Chrome Cache Entry: 609

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 480x800, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21614
                                                                                                                                                                                      Entropy (8bit):7.989915808051685
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:KJfNrPcy2F/u0KJmd6OUA0kTAhgoLbV8zjp2T0cUb/:4r0yuK4d6Oj0wAh7LB8zjMgLD
                                                                                                                                                                                      MD5:00135AF8D59D021189D0C0B35829B646
                                                                                                                                                                                      SHA1:EA62EEF405505EC66D90332260888E00A0547619
                                                                                                                                                                                      SHA-256:8E808D609C3D8A5DD94364DE67F0ADD3F942D847FEAE72283873F7CC42EAFD8A
                                                                                                                                                                                      SHA-512:8488F26A060C9AE368C4768076C77E1519E9B58DC540BA3F9CD782DE461C33A1AA5961217EF2854C9565C81D17E3092699A8793E7478DE0B4A9F5CE5BD5E500B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFfT..WEBPVP8 ZT...`...*.. .>.D.K%..'..:P...gn..M^......n...`._.|...4[{..%..uo..@~u..................w~........#...7./.t....~....f.%......{.'.....K........~.?...?..f...............?.?r........"}.jM.._......C...?.<m......`.......o.-.........?........o...?........U........?...}.........`.........O.w...O._.?5=.}_...G.W.......s...;..........`..'e;.W......N.U..z..vS.Uy;).....U^N.w..'e;.W......N.U..p..iq..t.....~`.x8.o..D..*~t.[..5Q.A.HU.h.9.._.z...m......K.....o... <M..]...`.....ZoGt+.=.0...7.L...R,..=..3t#.!O.,..bb!dTn...[.._)....*. .?...&t.v.2.q.}...=(...I... ..O.w...9.....5.Cp.Fr@..._.z..vS.Uy;).....UN....7d.y.s....p.D...7'...|.:+L[..z..........Y ..-=.KytM.......d..-_.A|' ...b...B.*.N.....h...'..C."...t/.>O27=3...=T8..r|ij...........H...U^N.w..'e;.W......N.U..z..vS.Uy;).. *_+..!...Uy;.r.O.,c.g@..[....!....B/Y......4...6.GMP...}........M...0`jg{.. *....y......32..F..a.[..x:.;...*./_.C...Z..y.5.1.Bpf.c.y..y$.<..J..m...+3./...?....A}...z.o.

                                                                                                                                                                                      Chrome Cache Entry: 610

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (51112), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):51112
                                                                                                                                                                                      Entropy (8bit):5.1207478745598625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:2FaBz5kWG/FEvrTg0o4kD3tT5MdpaVLPRiIEew4+b1wv:ma4WG/FEvrTg0o4kD3tT5MdpaVLPRiIx
                                                                                                                                                                                      MD5:E2BBBA7370C796EBA1506366929804C8
                                                                                                                                                                                      SHA1:4546F0505C11575604DA0805B0512BAFF89E9407
                                                                                                                                                                                      SHA-256:7C181F068A9241BD1BE8CAD10AEAE35539CA42D1734151EB05B98F09AC918454
                                                                                                                                                                                      SHA-512:2AAF529A48250BA5E2E1BE88496A811781F7DB5638F94B93430CE1CA6E1CD8630BFCAECC62C99C2B553F1C0BEE3C74638427E92F366A31EC768BB41092A584A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/bootstrap/css/app_2.min.css
                                                                                                                                                                                      Preview:#footer,#header .skin-switch,.actions>a,.actions>li>a,.ahs-close,.contacts .c-footer>button,.contacts .c-info,.fc button,.ie-warning,.load-more,.pt-inner,.pt-inner .pti-footer>a,.t-view:before,.view-more,.wi-preview,.wp-media{text-align:center}.ahs-close,.lg-slide em{font-style:normal}.t-view:before{position:absolute;width:40px;height:40px;border-radius:50%;left:-70px;top:0;border:3px solid #FFF;font-size:16px;line-height:34px;color:#FFF;font-family:Material-Design-Iconic-Font;z-index:1}.t-view:after{content:"";position:absolute;top:0;left:-50px;width:1px;height:calc(100% + 37px)}.t-view[data-tv-type=text]:before{content:"\f24f";background:#00BCD4;box-shadow:0 0 0 1px #00BCD4}.t-view[data-tv-type=text]:after{background:#00BCD4}.t-view[data-tv-type=image]:before{content:"\f17f";background:#4CAF50;box-shadow:0 0 0 1px #4CAF50}.t-view[data-tv-type=image]:after{background:#4CAF50}.t-view[data-tv-type=video]:before{content:"\f3a9";background:#FFC107;box-shadow:0 0 0 1px #FFC107}.t-view[data

                                                                                                                                                                                      Chrome Cache Entry: 611

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1157
                                                                                                                                                                                      Entropy (8bit):7.690876877349971
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Mmw3/boajKSiTn4mOWTdhZ/XkgtU6TAZPr+QhhBzj8mahn0:K3/bV1iDuchWo/TAZ3vZIM
                                                                                                                                                                                      MD5:EDBE04817F5AE0C3B55EB6817E4F994F
                                                                                                                                                                                      SHA1:AF6B182694C6F43B56103DA7F61A26B58EEF6D2E
                                                                                                                                                                                      SHA-256:6B7192F1710572B19C2A8ED9593A5D5383AABC9FE00325BC932DF7E20D372658
                                                                                                                                                                                      SHA-512:486D9BD54EBDA89117FD95EA9EEEAC14CB142CACFB3D115D1B52359A1773752CCBB4620B8129F5C28B96DF2CF17BEA6CC23143BD7EE5DEAA666C3F4890BCD3C9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/footer-icon-3.png
                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....szz....LIDATXG.Mh\U......y..$M.%-F..R5~..(.....)ESp.....A...Z..R....-.B..b;.J.Q(~1M*I...4..GN..$.t&3.n.....=.w....y.e^...Q. ..n 9@2...1&.H$....OE..."..C...`..5.....9..0.m.....s/.....f.~.Y.."...z......7_.G3.vw..G..\../.c.Z;.?@]........G@.\.._.....k.U..B.m..^.......r.......n.(.L>X..s...../.....{?....G.X.1f=.. .......Nz.<f.....)....Frq..DD."....a....N.:.e..........SL...[.nU.e.Z/...D$k..7;;..../.d2a*....s7..|.....O....M.6.S....D..k.6..9..........G.8~.0!"/&..iME........{......r.$_.p..V.ND~.p..o.-...m.$'..{.."@-...j..Z{XD.q....#...3...0==}....w.....'....("...#.....<.=.iQ.q..{?.qD.....C]]]_....&".P(....#....+..CM.".....".N>:.....3::.,........~..kz.ZC..j5#.S*9.$..Ed..4..%)V..8.....n#.uCEHr(.C..N...}...a8...<Y.<..$.{D.....C.Tjbvv.3.H|..*.'2..`....h.U...1....Appff&H&.'H..0e........_......E...8]-.....a.>.N.....QI..I.T,.w.|.Z..J.U.sn..sH.d.".f...1.W..D.G..J..GQ.MD...Q.AD:..Zk...a.E...x....SY.q._.?X.0..dY.H."..dDZTo..S.z.w...J5

                                                                                                                                                                                      Chrome Cache Entry: 612

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (712)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):19661
                                                                                                                                                                                      Entropy (8bit):5.724805524341729
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:gzoIG+JO4gaKWY7nrl8JwmfCjlrE6tAbuiFAgpLK4x+Dse4zDp9EFT8xK/qHZ6bu:mS6KWY7OJwmfCprE6tAbu4VpR+DgfjgW
                                                                                                                                                                                      MD5:F0D207AC51A0977CE569C3CF2BE2AAF6
                                                                                                                                                                                      SHA1:910ADBDCB9BE52CA5878FEE48EA3AC28A3CD7FE7
                                                                                                                                                                                      SHA-256:C555D37D2850FDED128053EC20B3A2FEE47AEA9DA5E4999BAF7C876B9FCCFC0B
                                                                                                                                                                                      SHA-512:09FA91D8293AD0A0F9EFF503111DF5AA1C94E9A3E9A6E92EF377DA37FB12D83A111EDB701DD7F4F14FAF4AB3EFAD6F6C0898E1D4AF548D2E11506551B6A58A83
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,EEDORb,EFQ78c,GkRiKb,IJGqxf,IZT63,IcVnM,JH2zc,JNoxi,JWUKXe,KUM7Z,L1AAkb,LCkxpb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,QIhFr,RMhBfe,RQJprf,RqjULd,SWD8cc,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Z5uLle,Z5wzge,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dfkSTe,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,gychg,hKSk3e,hc6Ubd,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kjKdXe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pYCIec,pjICDe,pw70Gc,q0xTif,qfGEyb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xQtZb,xUdipf,yDVVkb,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=RjJvI,DRmmld,mzLjxc,LRovxc,Y413Bc,J22eF,iLGjNb,ULFnWe,grWkAb,Lkzi5d,LcQwud,mmmrlc,YTx6oe,qk5AGd,kdbckd,dZ05Qb,UZStuc,xI1uef,PAQZbb,e3Zld,w08zce,UINLVc,iAQMie,NkwaS,GjTCAc,kpVlPe,qyd4Kb,g6aYuf,ElYdAc,PRm2u,pQUyNd,RBsfwb,ZMKy0d,Kfp2G,qczJ2b,C7e1Kc,xii62b,PZ1hre,FoxcOd,CKm2Wb"
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".N4FjMb{padding-top:40px}.yb6DRb .N4FjMb{padding:15px}.jXRZQb{margin-left:24px;margin-right:24px}@media screen and (min-width:600px){.jXRZQb{margin-left:48px;margin-right:48px}}@media screen and (min-width:1280px){.jXRZQb{margin-left:72px;margin-right:72px}}@media screen and (min-width:1440px){.jXRZQb{margin-left:auto;margin-right:auto;max-width:1296px}}sentinel{}");.this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.bv.prototype.H=_.r(251,function(){return _.L(this,1)});.var OTc,PTc,QTc;_.MTc=function(a,b,c){var d=(0,_.P)(""+_.uO("info_outline"));var e=e===void 0?!1:e;let f="";c="LjDxcd XhPA0b LQeN7"+(c?" "+c:"");var g=_.R()?_.Uo(_.To()):"";g=(0,_.Io)(g);f+=_.rO(a,b,c,void 0,void 0,void 0,d,!0,void 0,g,void 0,1,e);a=(0,_.P)(f);return(0,_.P)(""+a)};._.NTc=function(a){var b=_.P;a='<div class="'+_.T("kk2r5b")+'"><div class="'+_.T("edaMIf")+'">'+(a!=null?'<div class="'+_.T("bGJWSe")+'">'+_.Q(a)+"</div>":"");return b(a+"</

                                                                                                                                                                                      Chrome Cache Entry: 613

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (946)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):209867
                                                                                                                                                                                      Entropy (8bit):5.692065142670643
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:tGmOZSa32f6NEr75WZdzEwPUjV9TFEYWe7gH/BVdPGsRMOFWyBZEN:4mOZ1+wPUZF2agH/BDFW0EN
                                                                                                                                                                                      MD5:0B0BCAE45B57C8F594E5EE800E04816E
                                                                                                                                                                                      SHA1:58E0BE3E9E6328CB7A1BAAED89A118175B928BE1
                                                                                                                                                                                      SHA-256:9B3C512A30B86AC59B8957301CD61D618B96E7CBDF9CEE7DDD2B53334C94A2C1
                                                                                                                                                                                      SHA-512:8D415D16BE4696DDE85B33C0DD79A1257C173D7018EA99711EF7A24A951E7663411D49A68DD3C952CA6A77B67D8CE82F00B388B56FC9FC9E906AB24FDEA82668
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,EEDORb,EFQ78c,GkRiKb,IJGqxf,IZT63,IcVnM,JH2zc,JNoxi,JWUKXe,KUM7Z,L1AAkb,LCkxpb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,QIhFr,RMhBfe,RQJprf,RqjULd,SWD8cc,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dfkSTe,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,gychg,hKSk3e,hc6Ubd,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kjKdXe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pYCIec,pjICDe,pw70Gc,qfGEyb,rpbmN,s39S4,sJhETb,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xQtZb,xUdipf,yDVVkb,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=sOXFj,q0xTif,Z5wzge"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.vX=function(a){return"Rated "+a+" stars out of five stars"};.var cNb,eNb;_.wX=function(a,b){b!=null&&b.O()>0&&(a.open("div","mzPddd"),a.ha(cNb||(cNb=["class","pf5lIe"])),a.V(),a.T("wb5Mjc"),_.dNb(a,b.O(),"L0jl5e bUWb7c","vQHuPe bUWb7c",b.H()),a.U(),a.close())};._.dNb=function(a,b,c,d,e){var f=Math.floor(b);a.open("div","D5jpjf");a.ha(eNb||(eNb=["role","img"]));a.ka("aria-label",_.vX(e??""+b));a.V();e=b-f;f=Math.max(0,Math.ceil(f));for(let g=0;g<f;g++)a.open("div","CPcfF"),a.ka("class",d),a.V(),a.close();e>0&&(a.open("div","j3pqac"),a.ka("class",c+" cm4lTe"),a.V(),a.wa("div","UZExhf"),a.ka("class",d+" D3FNOd"),a.ka("style","width: "+_.Zo(e*100)+"%"),a.V(),a.close(),a.close());b=Math.max(0,Math.ceil(5-Math.ceil(b)));for(d=0;d<b;d++)a.open("div","pai7xd"),.a.ka("class",c),a.V(),a.close();a.Ea()};._.fNb=function(a,b){if(b!=null&&b.H()>0){const c=_.TS(new _.SS("{COUNT,plural,=1{1 rating}o

                                                                                                                                                                                      Chrome Cache Entry: 614

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (539)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1521
                                                                                                                                                                                      Entropy (8bit):5.153012792003547
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:kzeN2dRS/mQhuFnw2qgwK+YPiFocoqjk2faBcJauPKerl:kkqFw2TWgmbY2aBSayrl
                                                                                                                                                                                      MD5:D310E92B496A39DB1A9490E049540383
                                                                                                                                                                                      SHA1:3CDF9141F1F7BC8BD6C5F9C68897FD3ED9E28FCE
                                                                                                                                                                                      SHA-256:56436DA9659558912E6612ABBA1F0B1785EAF8E96E7BD9E8E31FAF9A0E5121F4
                                                                                                                                                                                      SHA-512:9485A2F0FFFB19AA13F18DA8344A2B23ACC8162B24BE3089D138AB9DC8E95E4508B480FA92274137CD49E85A8914996579F85882E1F4229D8587D8099CD27989
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,C7s1K,CKm2Wb,CR2XMb,CvxVpd,DRmmld,EEDORb,EFQ78c,ElYdAc,FCpbqb,FoxcOd,FuzVxc,G2gJT,GjTCAc,GkRiKb,Grlxwe,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,JiSSTb,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,M2Qezd,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,Qf3l6c,QxNhAd,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,WhJNk,Wt6vjf,XMEW5d,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,baVq7b,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fPcQoe,fdeHmf,fl2Zj,g6aYuf,gKWqec,grWkAb,gychg,hKSk3e,hc6Ubd,hhhU8,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,jZ2Ncd,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lDZ2Fb,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,nQqY4c,o6xa3b,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,q8s33d,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,wxpxie,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbKb5e,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=yABLaf"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.IEa=_.B("IniPib",[]);._.u("IniPib");._.lrc=class extends _.Cq{constructor(a){super(a.ua)}};_.Dq(_.IEa,_.lrc);._.w();._.JEa=_.B("yABLaf",[_.Rd,_.IEa,_.Dj]);._.u("yABLaf");.var mrc=class{constructor(a){this.element=a}addEventListener(...a){this.element.addEventListener(...a)}removeEventListener(...a){this.element.removeEventListener(...a)}dispatchEvent(...a){return this.element.dispatchEvent(...a)}pause(){this.element.pause()}load(){this.element.load()}},nrc=function(a){a.O=(a.video.element.play()??Promise.resolve()).then(()=>!0).catch(()=>!1)},orc=function(a){a.O.then(b=>{b&&a.video.pause()})},prc=class extends _.xs{static Ja(){return{service:{Pf:_.Oq,bja:_.lrc,window:_.sr}}}constructor(a){super(a.ua);.this.H=0;this.O=Promise.resolve(!1);const b=this.na().ww();this.video=new mrc(b);this.window=a.service.window.get();this.W=_.gi(a.service.Pf.get("Qrnzfb"),-1);this.ma=this.W>=0}oa(){thi

                                                                                                                                                                                      Chrome Cache Entry: 615

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 648x364, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):47592
                                                                                                                                                                                      Entropy (8bit):7.995695478540073
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:yPDiPfiV20xMI5s12KDG6BXOInhExGBomjZDfEUpfCOSlbZph7/Ym/V:yR2EY2ve/nhY+9fEUpfriph7/Yc
                                                                                                                                                                                      MD5:83011E0EF74A5BDE0D7A6F8D6539BCCA
                                                                                                                                                                                      SHA1:FB591798ECD82814DF2AF04AE25BBE9D1BA9378B
                                                                                                                                                                                      SHA-256:CBC16BB5D44E91AB8C95783D4BA9691500E542D9538E0B1C3A43D9A550CDA557
                                                                                                                                                                                      SHA-512:0B91166480B47F0D12BFCBC2838D842E670BB29CDD06DAE2FBF6452785D5D4F4DE2EE92C7889D488C6EC68208582FA23D2E01642D8F97DD38F091F0832B97CAE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/2YxpNUNlaP9_6GOzbvbMwG1DU-p9_GxmQMNxXyh_vcTptmj8VYZl6Kp-Hhaj1IcaNdA=w648-h364-rw
                                                                                                                                                                                      Preview:RIFF...WEBPVP8 ........*..l.>](.F#.!..4....fkj....J...,...........F.=..._w.;.;..|...u.?...|....q...7./a?...V.......K........x......?......[.{.....{.S.;...O........}.............._.|.|..o......w..._.f_.?..?.........'..:5......oU...+.=.......R.......;..W}o.....G............../.?..m>...........c..O....z....Ro.<.....5..G......'.i....UD... ..."..CFe.}c6..Wm(.1gcAl/. 2...j.4Rq.....=...mD$L9w_]#.....K...j......)G.g..h......j..@].u].M...h..........[...C..9.....-...x.......Y....O..}.S.CY:v.!.Q%..w...G'..*..xo..z9.&..r...U'.....u...k..!.VY.v.....rt....!.Z,...3D.......6.]O..:..{.X.].,Tq...{a....3...{..Q_Z.......)..@.0...M...b..C....,...8q|.k.t.@.`.A=O...M.v.{...P...z.....&FR...$...s../...Ed..:..6[.#...6:".P...9......e]lker~.1.+.@..Bsx.r..N..z.....o.8.G.k.72.+.t.v..[...%vs.C..r./]S...4.p...P...H.e...$P.<NHq.E.k......g]...9.JQ....40..8.&...q_....)5..l..;...=..:................u=L!.S4..#..6p.....P........X.t..D..c.......R..p....0G(\3c.aNl........eRl..f

                                                                                                                                                                                      Chrome Cache Entry: 616

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):212
                                                                                                                                                                                      Entropy (8bit):5.90424772242193
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:8Ai1Z9u5+PODIluOIcSjjaJBBWAi+1n1Fl9Ttdk:8d1YTIlHfSxAiYTt2
                                                                                                                                                                                      MD5:FD346EA942923CE6A19AAFE704CAF7E7
                                                                                                                                                                                      SHA1:3C36340BBBB2D0455604BD479A7BBE9FE355E2A4
                                                                                                                                                                                      SHA-256:D0BAA6814606024D57322978AFCBFA74C6053C79C27B0F431EAD6DE2EFEEAE73
                                                                                                                                                                                      SHA-512:7CCDE5FB098248B5E92553A5B57078E42500E2C0205AFEC0C39A9E1107398EB1B18136E115011D4C6CE2B7E7A91A421941F68201DF3C789F3D51CF56D84FA8D2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............VP8 ....p....* . .>=..C"!..... .....A......1..wd[....G............w3x.sscE.b..<...............}.......n_.X......@-G.P-...S.;|..m@.EXIF"...II*.......1...............Picasa..

                                                                                                                                                                                      Chrome Cache Entry: 617

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (14239), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):14239
                                                                                                                                                                                      Entropy (8bit):5.33042281088163
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:3I2fNaC8QiHbcggNFUWTgMe91sa6XCZy54:42fNaC8QiHbfgNFUWg17slXCZy54
                                                                                                                                                                                      MD5:70B4897108480DBE11C443C2AB7679C9
                                                                                                                                                                                      SHA1:70DBFD38A0F1FC3B1A7D9FADAB58786484C34F17
                                                                                                                                                                                      SHA-256:F268612BA59EAD1B24353BB77D66783BCC435AFF1C22BE5F93C40BAC3869968E
                                                                                                                                                                                      SHA-512:466084FA711D299E394E96C2260BD8BDF103CF75DA8869934C997A19FC884D6DDFA2E92CE253533A4A0C5D627D580E9A40EFB7155F1C8C0E9FBD3A2C3A06C2AE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/aos/aos.js
                                                                                                                                                                                      Preview:!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AOS=t():e.AOS=t()}(this,function(){return function(e){function t(o){if(n[o])return n[o].exports;var i=n[o]={exports:{},id:o,loaded:!1};return e[o].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}var n={};return t.m=e,t.c=n,t.p="dist/",t(0)}([function(e,t,n){"use strict";function o(e){return e&&e.__esModule?e:{default:e}}var i=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o])}return e},r=n(1),a=(o(r),n(6)),u=o(a),c=n(7),f=o(c),s=n(8),d=o(s),l=n(9),p=o(l),m=n(10),b=o(m),v=n(11),y=o(v),g=n(14),h=o(g),w=[],k=!1,x=document.all&&!window.atob,j={offset:120,delay:0,easing:"ease",duration:400,disable:!1,once:!1,startEvent:"DOMContentLoaded",throttleDelay:99,debounceDelay:50,disableMutationObserver:!1},O=function(){var e=argum

                                                                                                                                                                                      Chrome Cache Entry: 618

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):9270
                                                                                                                                                                                      Entropy (8bit):7.973786790952994
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:IIjELAJ6wo3pBvjZZXqtHxxZsMSqfQ5XHfJ889UqDw/GAmd:IIj+A4xdsfxX+OzSd
                                                                                                                                                                                      MD5:664690CC29246D3BB6257D8E7F790343
                                                                                                                                                                                      SHA1:19559A7E8B91BAD19798AC44BECBD3E376281CAD
                                                                                                                                                                                      SHA-256:2441EFA89E8D41238794A3C53F1223161A222B212CE6BFBF57B0E26BE9F4D0C8
                                                                                                                                                                                      SHA-512:835699F095AC4078A71F64903463D035E55D4D687B7C79991EDDB2B1A660A2F79A5ED0BDF1CC58D9D9DAD1D5BD25C12F38128ECE07478616FA768EF63F8C2517
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/pQqL4JTm_4PS4UGdvVNnv4f0AYXeRwItrhlAhu84_jtUO-xslQmRaHgrJouYh82OPps=s64-rw
                                                                                                                                                                                      Preview:RIFF.$..WEBPVP8L"$../?...M(l..Ar...G.G{..c..m.{.R...?..6.D..^0n#IQ.C...?.....n.p[...E.N.._..E...m#I.....>...........wb...3+#.nfs.../..e.........9_......[+.0..a{{..a.\s....IND.Z.....|..r.<./..}....#.S.h.S....^H~w...G'..pS......a<....D...,.%....m.j+g.s...b.0s.jH8iN..U........`[...Cn.L..c.s..}?/~.Q..Hgu.E...O.....N.$9.......9....p.pP..|.......P.2.1..<..h6.}.q....N.;...k..m.m....}]k..v.F.s.q...O#I..$.#.\....5..\.......m.Kwffff.ff..*..#3..0I.{...m....*U]...=....m.m.m..Y..rM....+.Jr..yD\..9..J..".oz~,D..xC....^..5..u^|..|.......;.x}...:+=&..li.he.I..E..~......".'..].R..{...w@..*6...%...J.27w.b=.h.A.N7...X..Q`..M.E=.HQ...R. .Hz/ .f.... .jM.p...._?..Q:h|1.KZ.U.a....0|..9.B?.B.^.. ....CH...&N.*....@..D.@.L....o.......1..R...r.!2...z^_sG..@..c>u..b...i....8B{)[e.]..~.w.l........q.U....4*(.B..wB#8DZ%.&.y...)+.k.mjx2q.E.5q...*.4:.F....]..'.....Td.....{.Gw.T....:..."..yk.W|....5o.*...;....q.kTB.I....@.....Yl.8.1c..%.&.-.P.H....

                                                                                                                                                                                      Chrome Cache Entry: 619

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (3456)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):13702
                                                                                                                                                                                      Entropy (8bit):5.678110697688477
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:5a+/ULIVilv9Y3Y5g7SyyepPaHv+tqP0QVhJDrErY2+ko:5FsL6kv9D55eFaHv+tqP0u4rv+J
                                                                                                                                                                                      MD5:E2F3117FA522F9EA73131AD8D912F465
                                                                                                                                                                                      SHA1:6994C4ECC5E8C93946F043E06CB49C1EE02DDB72
                                                                                                                                                                                      SHA-256:FEA4C0E6393997BA2D0F0D91D52519E51BB0A3D8645BBE652788C4ED258D9176
                                                                                                                                                                                      SHA-512:928FD51560D1AE5EC1E2BFE44EF3FAC756A69099223F3853885B267EC417FAF387C0E08170CA16AE9DAAC9F5452E72DB714AA292B5656E8D490E4D6C461710A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,C7s1K,CKm2Wb,CR2XMb,CvxVpd,DRmmld,EEDORb,EFQ78c,ElYdAc,FCpbqb,FoxcOd,FuzVxc,G2gJT,GjTCAc,GkRiKb,Grlxwe,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,JiSSTb,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,M2Qezd,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,Qf3l6c,QxNhAd,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,WhJNk,Wt6vjf,XMEW5d,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,baVq7b,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fPcQoe,fdeHmf,fl2Zj,g6aYuf,gKWqec,grWkAb,gychg,hKSk3e,hc6Ubd,hhhU8,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,jZ2Ncd,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lDZ2Fb,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,nQqY4c,o6xa3b,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,q8s33d,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,wxpxie,xI1uef,xQtZb,xUdipf,xii62b,yABLaf,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbKb5e,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=HnDLGf,t7vw0b"
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".x1OGnc{align-items:center;background:#123a2b;border-radius:2px;color:#28feaf;display:flex;flex-flow:row nowrap;font-size:.5rem;height:16px;justify-content:center;margin-left:.5rem;text-transform:uppercase;width:30px}.ZYIb7d .VfPpkd-P5QLlc{min-width:720px}@media (max-height:360px){.ZYIb7d .VfPpkd-P5QLlc{max-height:100%}}@media (min-height:360px){.ZYIb7d .VfPpkd-P5QLlc{max-height:360px}}@media (-ms-high-contrast:active) and (min-height:360px),(-ms-high-contrast:none) and (min-height:360px){.ZYIb7d .VfPpkd-wzTsW{align-items:stretch;height:auto}}.ZYIb7d .VfPpkd-cnG4Wd{padding:0 0 0 0}.IsssNc{position:relative}.AcxtQe,.TRaZhc{color:#8d8d8d;cursor:pointer;position:absolute;right:8px;top:8px}.YG3b9e,.adTxc{background-color:#2a2b2e;font-family:\"Google Sans\",Helvetica,Arial,sans-serif;padding:40px}.YG3b9e:not(:disabled),.adTxc:not(:disabled){background-color:#2a2b2e}.inFyWc{align-items:center;display:flex}.jmkV3e{color:white;display:flex;margin-top:10px}.KCiMwd{mi

                                                                                                                                                                                      Chrome Cache Entry: 620

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):7860
                                                                                                                                                                                      Entropy (8bit):7.955805602659907
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:LOV54+q/rQD1YSiWl2/05YdNGBhK/saP1FH:LOV5MkD1ZiWl8tzYhYP3H
                                                                                                                                                                                      MD5:46170B933402D7FAFD745DC0CEF0F062
                                                                                                                                                                                      SHA1:239B021E0FE588B2EA6875F584E46F1B09A53E9A
                                                                                                                                                                                      SHA-256:5059ED15F42F09678D74EF63726867324485A18A42A7283A4C0004EA6376CBE8
                                                                                                                                                                                      SHA-512:5E6E9B8B92731A6533365CA6CAD8222F907F02FAC571700BC67145560842D9A9AC4C1EFF10327ED17245220DF14ECDAA0BF1BB4FFCBF0AB0BEF123E7ABEEAE9A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/FVQXdzxDphpLdMRqIc5kG4C_Dc4AEO7-9uKHPt85v5_6Sp3J4mTV1S6P3ipLEoK6lDer=s64-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........?..?..VP8Lc.../?...M0h.H.6.?...........v~..<...I..wP=..4.I..m#I...|].1..4.8...T...B...PCw"w.2..HR..c...'3.?.....V..... ...6....0..6..f.7.oX...L..n....s.<..k....|....y...~....G_.......M...N..CA.6....v.......v%K.3..m...1.>..o...h..P"..T=.+.....g@....9{.5.{Q.K....2.......lD.....h..l.o.Q.......].j+.c.s.........A..9.{..'....G.?s..,.A.A!.K....m....!..m;$I..8......bwUW.3s.m.m...m.]Yi.N.K_."..m.m[.Vj.}L-l..}...m.V...?..zl.m...hk.&..UO.m.nlk[.c.dI.P..\fffff....)f....rs....."....di.9z(L...+ ...CC.X.!...JTj......H..&.....x).v....uK...e1v.o.So...4....".........B.B.....-.*.C...........1..0...l..RV.X&.).`.f.l{c\(X.P..VZ..P..@C...x.iy...`.g......-.W*.R8..2..R.....T. 9=t.~.!B.a..LT....N.X.)..Lb...p^}.2.2.."..V%PK..V...9.z..3...... .#h......./p...C0. L.(.0:. ..^H.}...E.p...(@$....!.....z4.@....(`Q.IB[.(...).....Qn%..#....^_.....`.N.I!e2..S.r...hI..W...O.y.....a.5%.......eL.[.]..Q7.P.."."....%.""...);f...8...$.$..b..'9...x.

                                                                                                                                                                                      Chrome Cache Entry: 621

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):67646
                                                                                                                                                                                      Entropy (8bit):4.558297338561872
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:kQy9Ep0a8vb06yZOWPGlJOZHu8UTrAfW8Et16tBtLe087UgbJKUET2O4t79Si5nY:7y9cgEe4iY
                                                                                                                                                                                      MD5:051CE92715B8E1FD2C4DD03AF564CA7F
                                                                                                                                                                                      SHA1:36BAF424A7FA3754CCEAD05557F835772316BD68
                                                                                                                                                                                      SHA-256:F7C4A8AE0521C202AB8183917ACF5E425450F56C53354F6F1117B1288FE22F38
                                                                                                                                                                                      SHA-512:A501806B88C02950F6AD81CC3B9E44A754D77B890EA7AD0EAC9CB1D7655BE7512B758C94D05407DBDBDE7A318CA5DEDF974B34304E36F3AD8F34FDC21024A8D1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:............ .(.......(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      Chrome Cache Entry: 622

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):2810
                                                                                                                                                                                      Entropy (8bit):7.887433756129589
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:bvu4BqXz5NW8pECq2nStghcANV7y6wmkcyvcrZQ6ekuL6QCEZVWfLJzVIM+Y2jAg:bw68TSyhce3wda3ICEZYLJx6Y2jAZ5G
                                                                                                                                                                                      MD5:24FA213EDB52E2405873BD5979E2E87C
                                                                                                                                                                                      SHA1:79CC0BFEFFBD6B23D55A6450A31739E29B2F0F0A
                                                                                                                                                                                      SHA-256:BBF7218DD9F40B1CC7D09D487F6DB6681DE42E4A230BD10D2B19F6AA14FC20E7
                                                                                                                                                                                      SHA-512:F82E07AAA75AB9EB95206D3EEC6C4612A720DF5253D276061625502804D7F04D439945E8D217A87601908583EDABECF4DC3338DECC20C0FACBA7F9D986695693
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/download-new/device-3.webp
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............ALPH......t.i...m;).m.._a....m'%'E.v.,..{.`.v#b.........e.........a.`4b...bb.3. ..n........_$..7.^gP..?.' f..".R..:..0..../U.6..c.0..4e\.{.......d ..:h.d..c.....4`.B..0...TR ..-E..%...P.`!$.3...S.O.?....S.OAm.b..a.:......:........W....-.31...F....nc.L.0.........]..;~.....i.....i.L...wl)8.Y L.`......>.1....<...o..0a.../...I..x..\..[C$fNM.q9.....4 ....x.W..3... .\G3LPp..+r.....\.Fs(.]v.{L......K...@.s.\k.........H.Dj.7...._.F7%......Z.?..L...,.t..Bo.ev....}..n#......~k..4.F.a|=.:..n<.2........S..h.N.....qw....Fs4.]n..LL..<.8.}y ...-..Z....S.<n.&.]..X...3..U.l..|....3./_.w~X....Y.4.....5O^v.....i....Xe..+..^..*).$.Yp..Wb^.+&..5..F.%.H..T...I..BH0.. ...$.....((...!..."`.....r." .1...........b....$.....R..# .A ..j..t@hOY...VP8 .....4...*....>)..C!..%W...BX.T.i...X...w.....8.....#....O.n......?V?e=.?.=.~....B.Q...S.....k...g....._.....o.Z.ts.....nY.`w..3A.So.1.{..<.la...n...".U<.....K..7=.'..c.N....q..F....koc.}&....(..Xr.'

                                                                                                                                                                                      Chrome Cache Entry: 623

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42322
                                                                                                                                                                                      Entropy (8bit):7.99596563855182
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:eVTTtywwXjTdLjwT35hjsan6BzmcfM6DDyLRB3Qu8zgy1vXUGFcndCKLev4:eVHvwtLUhQa6Bz/MSDeRBQuigydpuB44
                                                                                                                                                                                      MD5:28072429C2565CD8226F3FE62774AA3A
                                                                                                                                                                                      SHA1:AC550713A85133748B331306EF7FF084826B4CBD
                                                                                                                                                                                      SHA-256:410CF2E9600AE8EC37701944F7ECCD2EA54E82D91FF19559F4E8823C1E344958
                                                                                                                                                                                      SHA-512:39B59CF822578E57AAA6F3888B425D385BDA24D8511A4CE89CA26274B497619880A1C2C8DBE6C21F2C531AC15A2A2B5D82C2938ED98BCDBEAEC1D07006A5DBFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFJ...WEBPVP8 >........*..(.>m*.E."..07.@..fm-*.q.[....?.b.......HnM...ZM.w........y....c..._.oa..?..S.......c............~.?.......Q.9.#....g..^.......?w=..........{....(._...o.|......._/.....g..........?..S...... .S...c.......^....S....../._..~..........=\.5.W...........~.>....k.O....._........W..........n...O..._._.......e.....'...../........#)'.u{u...4$.e0d...I4..);^...R..i.@..4...(...GH......N...k...=..w.]WJ./. ..|.G..0..f..........U....P6~.h=....#...|+...}...T.67.Vsn.F.....a...c.k.l.......t..:.(...zx...0.'..,-....;..V^..a".Q..."xZ..`.(6......V..s..........f.fe..djb..*..{#Im......x.)....V<!U~..YG...&c...G.W.g......z..C...x....T..i.......N..Mt...o.iL...;3J}H.n.WY9%.C....q..u....T..!....!...v.3.*._...4....s}.tV.7./...jx.S[..RLH..l..V.4>..../G....t...6.TO..F2..c....I.....Vo....._..k}....&.l..xs..@0..Jw...e.h....mN:.....T?..T...+...L'.>.4..=..kOc....9......H.8..."J?*E..@..5p..[.2oG....z.....F.i.o..........k.W.ub.......Z.7.>..5.e....A.*.*P\.

                                                                                                                                                                                      Chrome Cache Entry: 624

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (325)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):4459
                                                                                                                                                                                      Entropy (8bit):4.942833394996034
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:Xu4iK9hZdApMJ2GAGmJaLNIoizXckzTiNTWt06q:DcJGNWh7q
                                                                                                                                                                                      MD5:11F98AFC13B789986764611903430A32
                                                                                                                                                                                      SHA1:99C808471934E44CBAF256E2257BBF508D8FAD11
                                                                                                                                                                                      SHA-256:DC601493C7574AF0A11A020C640FEDAF56B268FA9E5609F32F32003360CDBF79
                                                                                                                                                                                      SHA-512:CBD100D7421A1D790718C83FAB233A00CE0C3856CA95F630C01FD0D9AEC5045ACE286ED5BCAEFA6181D863B0ABA25764BD887C0A65F390EA772378EFD9DCA2DC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/auto-activity?guid=83f4c120-7dc1-4372-b266-ca17c2470b3f
                                                                                                                                                                                      Preview:<!doctype html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">. <title>Limited Time Offer</title>. <meta name="keywords" content="Neat Reader,ePub,ePub reader,Computer ePub reader, android ePub, iOS ePub, Windows ePub, Mac ePub, Linux ePub, online ePub, online ePub, browser ePub"/>. <meta name="description" content="How to open ePub? Neat Reader is an ePub Reader designed for all your devices. You can read ePub file on smart phone(Android, iOS), or PC(Windows, Mac). You can even open ePub files on browser(Chrome, Firefox, Edge) without installation. Get seamless reading experience in Neat Reader"/>. <meta name="apple-mobile-web-app-capable" content="yes">. <meta name='apple-touch-fullscreen' content='yes'>. <meta name="apple-mobile-web-app-status-bar-style" content="black">. <script src="../express/vendor/flexible.js"></script>.

                                                                                                                                                                                      Chrome Cache Entry: 625

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):121992
                                                                                                                                                                                      Entropy (8bit):7.996706160796436
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:3072:gYzuKeEbcB+wGo63eqqjhNJas2UVziFk/LPsD12OjDk:hiKDcB+wGo63e79/aSV6krU2Oc
                                                                                                                                                                                      MD5:06E82BFAC9B919B5E86C35CCB522ADC7
                                                                                                                                                                                      SHA1:81052BD4C091908CEF13EBB7660CB713E53A4FEF
                                                                                                                                                                                      SHA-256:1B0C7779ECCA2B676CF0CF667F81357491A031EBB2A8FC8FD84DCF9AD6B6FE20
                                                                                                                                                                                      SHA-512:10B488C742768D80525569B34493DE2EE7D82AB0516259BFD2A5239935FA1A98DB045035D2D09DC8436B6C4B8D3A2BC05E0DDEC26838DF2F4D0F0D0712E73FB6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/v3/index-banner-3.webp
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X..............ALPH0.....@..:%...(.....1...]k.p......;..W..{...f.sBX@b..!^.......y._....8.#I2...u.<.2E...WUl..Z..c..w..q.j.\%...J.T.R{$..Rna.*yhHhhH..<J.R..Q.,.A-.D.j..>...j.....,...(.r..`../VQ{...j...*.....]|._a!.....3.z..@L...R3$.......z..M.....d.T....&N.......{....7i...N.7~....Z...L.y.....Q.-f....G<A.<Nj.f.....V...8`.0W.<=.....@....._..R.e'...6...9...t(=#..Xn,7V<..Y3R....X+.FK..t..Q...RM.....x,~.u.Wn,..=..6n.~..S.lc.q....oX.v...Y.ju.....t.J...j...,.....4....|i..0]..Y.......E.M...7K\.....Z..7......i.."1.1._J.;{...>..Y..3o.....m..h...?.....\d...[S..qr...spk.z.9..Q...{..`._A[..."./SO.m..?.....+E>4%..]._.y.V.Js...-....r.?M..~l...%.S.~e..f;).@.W......j.."..u.X...D.5_G.3.....l..z32.."'...c.%G...l..l.W.d...M..uy..\m.o.S....m~...$U........".._<...<...@V..{....J.Q.t.......bf...wO.w.saO..D...E.+h...%.......z...3..|..U9.-.>*.X.%Y.-.~.Ma.Oj.!.y.%7.....v..5;.$..&.aF..E.XV#f.T....eF."....x<.=..47V|u.'L...&.....#"/,...nB

                                                                                                                                                                                      Chrome Cache Entry: 626

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):44215
                                                                                                                                                                                      Entropy (8bit):7.97839217732228
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:gGvyJk8FYFkSjgLyiz14beCYi7trcC286Fz9QYZlLLU5OHqaOjAMlam2m6F:tvMFxSjgLTzGiCYi2Cf6d9V/LCOKHAh7
                                                                                                                                                                                      MD5:E01AC3670BDE78937AB48F04DD66EF91
                                                                                                                                                                                      SHA1:9E31EF13BF8668F422F7BCC8B670BBCF8D9B1678
                                                                                                                                                                                      SHA-256:FF8C3CE69ABD41161AF5A4DDC79D844F44C728199E3A098C6A86CE9C9F49F446
                                                                                                                                                                                      SHA-512:19A1F5A457C2349A51EE645BA45835BF4255C210EFAE043AABEBDD31784920B1A79140C9C78D9EC17BBFD5D928FD251D9D22568E23FF6E66A7FD0DACE41DCA25
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:......JFIF......................................................................................................................................................h....".........................................S........................!..1AQ.."aq2..BRS.......#br...3.....Cs....$....4c..%5Tt..................................D.......................!..1A.Qa."q........2BRS...#...b..Cr.$3...T.............?...QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A..QD.QE.A...?.........t.~G[O........lX.....h......v.................|.....u.f.P......y....v...?........&.S....b....)..|...W.O.k.>...6'..U...m..VQu..0..+'..a...p.iY4.g+*..P.....@F/Ei..<_.a....W../.0..^..).k.,...........1.I....._.A.....{.....`..'....Hv...L?....v...L7...=.Y.f.kR~`....`...}{...`x..}{....c.~Y...K..

                                                                                                                                                                                      Chrome Cache Entry: 627

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (505)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3101
                                                                                                                                                                                      Entropy (8bit):5.510070190789468
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:ZCVhQsIjPEUIitHP11AUj58mzz9HRFE9l:KQXs8tlj5xf9xKP
                                                                                                                                                                                      MD5:2B56F2AECF54445041C8189BFD7BCF28
                                                                                                                                                                                      SHA1:00A831A39B5654C3BA6481BAEF24C9EE2A3CDB47
                                                                                                                                                                                      SHA-256:02C64C09327E8BB76ABA9F28A7A1A0944145A9C0C13ECBBEE294C6992E9A8379
                                                                                                                                                                                      SHA-512:67C7DBEDB3771D6D6B0971FBAF335892E7A041289173F14A37F25F87BC08617E234BA3E69E5552BA53F91430E02EB8431CEF1750748F0AB740BE46E4B92AD08C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,C7s1K,CKm2Wb,DRmmld,EEDORb,EFQ78c,ElYdAc,FoxcOd,FuzVxc,GjTCAc,GkRiKb,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,g6aYuf,grWkAb,gychg,hKSk3e,hc6Ubd,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lDZ2Fb,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=fPcQoe"
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".PFAhAf{margin-top:5px;text-align:center}sentinel{}");.this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("Qg1uEb");._.EXc=_.al("fXS6ad");_.FXc=_.al("tb9cac");._.w();._.u("gkYwcd");.._.w();._.es=_.B("zmABtb",[_.ek,_.ck]);._.yGb=function(a){a=a||{};return _.xGb(a.Rda)};_.xGb=function(a){return(0,_.P)('<div class="'+_.T("Fx1lse")+(a?" "+_.T("jy7Abe"):"")+'">'+_.CDb()+"</div>")};._.u("zmABtb");.var zGb;zGb=class{constructor({Gd:a,o6:b,Si:c,Qx:d,Wk:e,Mm:f,Ao:g,zq:h}){this.ma=a;this.O=b;this.va=c;this.La=d||c;this.H=e;this.Ma=f;this.Fa=g;this.Aa=h}W(){return!!this.H&&!!this.H.gp()}oa(){if(!this.W())return _.Xf("No data to return.");this.La.append(this.O);return this.ma.fetch(this.Fa(this.H)).then(a=>{this.H=this.Ma(a);return this.Aa(a)}).then(a=>{this.O.remove();a.JA(this.va)}).Uc(a=>{const b=this.H;this.H=null;this.O.remove();throw Error("ze`"+b+"`"+a);})}};._.tV=function(a,{Si:b,Qx:c,Wk:d,Mm:e,Ao:f,zq:g}){return new zGb

                                                                                                                                                                                      Chrome Cache Entry: 628

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1752
                                                                                                                                                                                      Entropy (8bit):7.853145468821245
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:SMX8/F5KiZN4DBY68Fp3OsGlm4EupVgzGaQ:SS8NlKY73OplmoAKH
                                                                                                                                                                                      MD5:DEE02D2182FDDBC660873A3E9CDBB96F
                                                                                                                                                                                      SHA1:3A92676F51038E0450AB8DDC39DE965106A2B702
                                                                                                                                                                                      SHA-256:B13FB45F8B5858F1B529B347E6F605D4513361D3B9F60BDEC00DE4E7B685AB9E
                                                                                                                                                                                      SHA-512:294E263A97E858AB69ED35D09B232DCBB40EB73C03F356B0469478CBC04DD2B4DE96E7B6675F361156390E7A65D68CF1F417A3EDD9C1C538DB09B1AAAB784C2A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........?..?..VP8 ....P....*@.@.>i(.F.".!9.MP...b.....!c.+..).+.w..Y.._.~..pZ.w..]....6.....~.o@.....#./6.X{.yg{....{..w..2<.E....=.4W..x../v?B*Hs7.b"..r..z.F.Ro.`zX.....!..u%.`...0./=F..a44$...v`.A....... ..\.`Ri.b........*N...j.Z.*....A4N=...u.................,...>.L.!.{...R.....$..6~..\....p...nF.......+....0.g<...\....q...M_\....{%..Vn.%..a..k.'.k..y.....e".].O..sQ.....f[...2...].2.4#Q..[....>....[q....0.[..4.`v..'..J..".}I|jS&....e..B.A_."U?.Z..Lk.zl]..~I.7Z"9rw..:.3M......{f.r..AD..3TG.....N.@.wG.....-..`@.3...:<.M.4...UH_A.......q..2...}.mm....H.Gp..+.'.&..X7&....G..6....;vXY*...V..b.D||...........].. H.=.SA.=^4.g.w..W.=G..y9.......f....-wf..AY....._...3...M...&.6......T..f.T].....JD..?Y.QE....Q.R:".l.+.Z...!I....Y.......).g..7@.v..|........'.yX....c...02.E.(.9...\.~.....e..~EV..c.y...ji.I$faU..(^G>Lz$...s...4Q.&0. .L...M9..l...u ...b]..B..Y....hu..Y..8 ......|;..."...P._..........A......T........)4._ndG...h:ep..>...UW..

                                                                                                                                                                                      Chrome Cache Entry: 629

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                      Entropy (8bit):6.676048050841229
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:0Zrwlp8NJrXNwje/UwbgXwYIlGKZqvqJAy7ZrUilBCkzX/BfTA1D31n:0ZklpUXNwjecwb7lGurFUihBLiDF
                                                                                                                                                                                      MD5:461204FBB9CB6D19F763B8EAECDC01D6
                                                                                                                                                                                      SHA1:95354D81968469C5A9EE2DDEF3C84B9F788802D0
                                                                                                                                                                                      SHA-256:FD29716389D0077F1D88C7ACA6A408FDB9E27A9D33FBD74B265CFF2F6A2E3786
                                                                                                                                                                                      SHA-512:B7BA5AB186109447B9C6317F7E9EC8BCBAEF65B1A0EC96FB12334A3C0DF97430B142B2C3C7011C0B7D09C425C8E673CEA79F4EF126FB01BB0D8E23409A177BEE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/IciOnDFecb5Xt50Q2jlcNC0LPI7LEGxNojroo-s3AozcyS-vDCwtq4fn7u3wZmRna8OewG9PBrWC-i7i=w48-h16-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../........G...C-....13+N.8....3.q.G..M..G....~.4.2IP_..)......Z:.}.....$...... O.....,......QU....T...$.?%.....z);I2Z9...=$...{./u..2p.cj.\...%m..

                                                                                                                                                                                      Chrome Cache Entry: 630

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1272)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):87911
                                                                                                                                                                                      Entropy (8bit):4.480568495533043
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:bi8OWdxh4l8LK21pQgzw8Rke8QL7xLmlajmqRBBm+K+QvTJohAo:nKPjebPxLqo
                                                                                                                                                                                      MD5:7AED4A0484A4140B855E7D7A91BEDDB6
                                                                                                                                                                                      SHA1:31888237388AF30BEC276405DBFED84996F0CD42
                                                                                                                                                                                      SHA-256:0CE8B5A4F844C4520A83C964BC0DD65AEAD2ABFC634C1133360FB59783B2AEFE
                                                                                                                                                                                      SHA-512:5EE5A1B4438C099B65419093449F51D67E0B834B3FFE11C1E5DDC39BD9AD08BBB4D5996662C4392DF74F3AE3844EFD2EFEBAB5ADDD053C1C8B96D81F4F808619
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/download/android-epub-reader
                                                                                                                                                                                      Preview:<!doctype html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">. <meta http-equiv="X-UA-Compatible" content="ie=edge">. ..... <title>Android EPUB Reader | Best EPUB reading app for Android | Neat Reader</title>. <script type="application/ld+json">. {. "@context": "https://schema.org",. "@type": "SoftwareApplication",. "name": "Neat Reader",. "operatingSystem": "ANDROID",. "applicationCategory": "UtilitiesApplication",. "aggregateRating": {. "@type": "AggregateRating",. "ratingValue": "4.4",. "ratingCount": "8625". },. "offers": {. "@type": "Offer",. "price": "0". }. }. </script>. <meta name="keywords" content="android EPUB Reader, android epub viewer, epub viewer for android, open epub on android"/>. <meta name="description" content="Neat Reader for Andro

                                                                                                                                                                                      Chrome Cache Entry: 631

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):40532
                                                                                                                                                                                      Entropy (8bit):7.995619656406213
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:k/huNy3xHHS61C7DLFLn2XP384ueY4QKf9roJ+nlwa+z7cz6Q5pmxuP8mh9:kgy3xnz1kpz2XP3yEN9nnSa+vW15oxuv
                                                                                                                                                                                      MD5:581F3D3D49460D70B7727752C3339F13
                                                                                                                                                                                      SHA1:C70220D89F25E1310C2180F280920414A94208B2
                                                                                                                                                                                      SHA-256:B1C9E778A9253BFEC9874245823B23EE8C5BC40D131FAB451F33920EB418E145
                                                                                                                                                                                      SHA-512:020FA8BCE423A980065B7FC72CC61183791FC8A472BFE6B5D077580D787050EBB030F98D6C456DEFE6B1F2CF7B23C76CFA487A1BF3290814EC6BF11C8A7E8C20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFL...WEBPVP8 @...p....*..(.>m*.E."!..X.....fm..#..(..\.r......|..O...~..........?................S...w.O.?R....._.s...|.........w......................K.G.G./.........?..g........i.#...........{......g.K.s..._.}..a.....?/...!.g...o..._..w..|{.Oyo....G._............z..7...../....z..3...?.?......s....._..&...............>B...u...?.O.?..n.......%...........mk~...9.T.......).g../..6{.!.[.."J.o..V.':0.N.{.*......ol.5.........g...y.../ .74..F...8,_.l...i..]hY..!.ky..Y6..9...F.;..e...7!n.?.........i....d...%g{1I^4...,..B.......^..G.l..2._.V...t...5.P.{..........U...K.... F..bG`.h.}l`.......:...p....9..w.V.p..]..........g..}U..I.N.b.w....l@.........j..0........Qq.W.vlG$...Q..... .]..[.+.....D.......0.....h8....#s?.n..F...0...;. L.......2-.x ..../xzY[..J..q.....(..oN.6..p.-....w......).)!i..P..a...F...{ :.XL.S......b=.VD......q.....}......P.|.)76.....:l...Z.+.\./...d.0..L.T......m..U.....v.o..<....KL..{.<..).X./u..f.V&v.]."Um..."s]9.T.....l..L...

                                                                                                                                                                                      Chrome Cache Entry: 632

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):9550
                                                                                                                                                                                      Entropy (8bit):7.971439000038557
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:SAfXrP8p7gZ3Rwn0Tp1C/PXWT2ebdoWjMh8XNBOkxTRFex0kxoyUr:lfXo7gZ3Rw8p1C/PGiebdoWjMcUk5ROM
                                                                                                                                                                                      MD5:34ACE6A395DA2BDBD1967DAD331B91D3
                                                                                                                                                                                      SHA1:85594FF50B11469D6CCD8F8678FA5F57F696CE95
                                                                                                                                                                                      SHA-256:B3B00AC6557B0452D11EACAAAD459541F6739238152D38889A73D35CF927872F
                                                                                                                                                                                      SHA-512:C6EEF3AC2D57893C0E19EF6A9F24A1FBA876BE159267274224C9673299B1C37F4E38CAC6FBF6F9BC50F6CAA3F9549253F969A84DC68CE5D2C1FF495D250AB31F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFF%..WEBPVP8X........?..?..VP8L.$../?...M(j.H.d...........qt. X.U......j.m.:..D......p....m$IjF`1...#....*V.$......f.....Bq...P..P..&.........%D....A0..'....q%..T0.....>]...{.../..<..)E.g..Q#...p^a.Sq.+..9c.B..nT.1.X.....N.....4.x.._..h.k..]p.A.830q .......5A.q'..v.......Zh....v..k........E...#.G...F.....a7.....h)YI.<...m..m...U..m..Y..]go.6^.Y3..b..m..j...7.0.. A2D'B.hJWR.K......49.....Sw.*q%.p....C....{.'....J..;U..)..w.mY...2g..P.eA2V..-@)..W..vU./.$.(..(r.U3c#22+..F(h.Y.....!..B....u.U.:.0Z.(`q.....P..%_..,..9.K.....0...EE.%..7*.g+.........E;.?j...?T}.?...{l].s......._....3._..M..)JD.b....6........o..F.=.w.<].m..t..+N......=?.>x..>...oq.7......b...J.>v..O...v....nx...>I].e.....L.7}X..oO..:3....G...z~.t.....\..c%#w.>..Fy....o6..C.b..........}...j..U.DU.Ge..'...n.m.\.0.....?..pr\.]...W.+....9W.u..o=....}.rUx2.K1...F......\t.I...g....=t..\zzX.........k.q.~(.....>.......[.'.G~...:...}...={...p....`..~....6......0QE.T.w*...ZM......?..

                                                                                                                                                                                      Chrome Cache Entry: 633

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (967)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):5561
                                                                                                                                                                                      Entropy (8bit):5.6424838842644505
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:kGn9IaCZPU+KXtBAXeKqFUvJcyQ8TILf4K/IEvInl:jn6aCZPPKXtBAbqFUvJ+8TK4KfAl
                                                                                                                                                                                      MD5:42A6D513E0331BF8568D7D426E9E5F62
                                                                                                                                                                                      SHA1:4F84F554F55BB53EAE3AEFA0FD9E10DDC7C48353
                                                                                                                                                                                      SHA-256:D2DAF09C61F8E03765F8AE0C3F594C3D37BF53E50DDF416BDC4972427B6C1372
                                                                                                                                                                                      SHA-512:D3ECDC18F12641194EF555F13EBF27433D68B372FA7B368387EF64184CFAD2FE2CCC5DA3258AA49A9263F46AF5DA0627A229B6FC963F661BBD3312ADFB6CDAB8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,C7s1K,CKm2Wb,DRmmld,EEDORb,EFQ78c,ElYdAc,FoxcOd,FuzVxc,GjTCAc,GkRiKb,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fdeHmf,fl2Zj,g6aYuf,grWkAb,gychg,hKSk3e,hc6Ubd,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=lDZ2Fb"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.tDa=_.B("lDZ2Fb",[_.or]);._.u("lDZ2Fb");.var gcc=class extends _.z{constructor(a){super(a)}};gcc.prototype.qa="K4YEGe";var hcc=class extends _.z{constructor(a){super(a)}},icc=[2,3],jcc=class extends _.z{constructor(a){super(a)}kb(){return _.F(this,_.$s,4)}},kcc=[7],lcc=class extends _.z{constructor(a){super(a)}UB(){return _.F(this,_.B1b,4)}};lcc.prototype.qa="swBvle";var mcc=[2,3],ncc=class extends _.z{constructor(a){super(a)}},occ=class extends _.z{constructor(a){super(a)}};occ.prototype.qa="XMKGyc";.var pcc,qcc,rcc,scc,tcc,ucc=function(a,b,c,d){var e=_.zW(c.kb()?.H());const f=e?"3121|"+e:"3121";e=_.X(h=>{_.fh(c,_.Ng(c,icc,2))!=null?(h.open("p","WcV9v"),h.ka("class",d?d:""),h.V(),h.print(_.L(c,_.Ng(c,icc,2))),h.close()):_.Og(c,_.gt,3,icc)&&h.print(_.xW(_.J(c,_.gt,3,icc)))});const g=_.PN(h=>{h.ka("target","_blank");_.QN(h,_.NN(""));h.ka("jslog","197536; 1:"+f+"; track:impression,clic

                                                                                                                                                                                      Chrome Cache Entry: 634

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:PNG image data, 1520 x 885, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):54845
                                                                                                                                                                                      Entropy (8bit):7.800274888616153
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:a9ZyHzX61i7rB78G+sSwGb59dndhppBKlBpeGGkoMp:VzX647rB1VSwGb5/ndhpmBI/Ip
                                                                                                                                                                                      MD5:A19170026864DFE39B7A2A2A545E3E1F
                                                                                                                                                                                      SHA1:E08C5B973ADEF3FB9EE826F7B6B8735D3353BCA9
                                                                                                                                                                                      SHA-256:DFEEA1EADF4EA7811D7EB096A386E18167AE4201AD499205A31037738033AC4D
                                                                                                                                                                                      SHA-512:21ADFEBB61471D92AECE00406E43E467727E61D2BE40D090E7F65D1787C9266FF8565B5CA829C0B446CB67C9B49C84CC7C7C9EB07B7360725340A898A108072E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/img/index/activity/activity-update2.png
                                                                                                                                                                                      Preview:.PNG........IHDR.......u.....0..&....sRGB.........gAMA......a.....pHYs...t...t..f.x....IDATx^...$gA'l...8...................V7...........C..C.A ....@..B.`...d..'.$3..L&..9..OwUuu..tW...L.=.}]......S..uM.w......`.(......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.)......`.).a9m..^....z...x......;.~8.n.aw8...|......<....<R.w"Il.\>..}.......>.....L...@..g..k?....;RL3.].[.=....Ib;L.....{.P1............?[...'_.'l...Z.......[......^.e].YB._.....W.......D.?...y...n..".......E.9~......n.S.g.S.s<.....W."..'._.....X<....~...W.,&MY..~b.gP.....?...[...\.+.....,.[...G..bPB..p..b...+|...".ymx..j.).........b..3....a{1u...`b._:.nX3:]....H.._.'.tF.<o./.J.S..3........M..(._ry/...9..}.Z.....kO..u..17..7.w .8\.?.Ca.C.....|.>..].z...`/.......{E.ux.o]..?..7.jM..>..,......s_.......A......n.....3..e......

                                                                                                                                                                                      Chrome Cache Entry: 635

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1266)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):1300
                                                                                                                                                                                      Entropy (8bit):5.30524883704663
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:hYycgSHiSlajeJvJDyzGpxH019FEYvNvZVusgDUmEZ1r2ilHhiomA3ef3EQJZomW:hYyZSHvciyQHEmENRVcUzb7H6om3JXof
                                                                                                                                                                                      MD5:4412BF8023109EE9EB1F1F226D391329
                                                                                                                                                                                      SHA1:C273960AA874A87DD022B5E597887142F1B8E34F
                                                                                                                                                                                      SHA-256:D40EFCAC911D8964F3728EAA767DE281306FF55BA9377435A3364D4D1E1613F6
                                                                                                                                                                                      SHA-512:DE3DD553A582E6B3D00782DDD639CB57B29DE71AFE72AF5ABEF870AB36C7FED68244D511A1E129A0F04AF690F27AE9304B1C113C9F1F0E0BD85DDE9291A6764C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/jquery/jquery.cookie.min.js
                                                                                                                                                                                      Preview:/*! jquery.cookie v1.4.1 | MIT */.!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):"object"==typeof exports?a(require("jquery")):a(jQuery)}(function(a){function b(a){return h.raw?a:encodeURIComponent(a)}function c(a){return h.raw?a:decodeURIComponent(a)}function d(a){return b(h.json?JSON.stringify(a):String(a))}function e(a){0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{return a=decodeURIComponent(a.replace(g," ")),h.json?JSON.parse(a):a}catch(b){}}function f(b,c){var d=h.raw?b:e(b);return a.isFunction(c)?c(d):d}var g=/\+/g,h=a.cookie=function(e,g,i){if(void 0!==g&&!a.isFunction(g)){if(i=a.extend({},h.defaults,i),"number"==typeof i.expires){var j=i.expires,k=i.expires=new Date;k.setTime(+k+864e5*j)}return document.cookie=[b(e),"=",d(g),i.expires?"; expires="+i.expires.toUTCString():"",i.path?"; path="+i.path:"",i.domain?"; domain="+i.domain:"",i.secure?"; secure":""].join("")}for(var l=e?void 0:{},m=document.cookie?document.c

                                                                                                                                                                                      Chrome Cache Entry: 636

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (706)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):3405
                                                                                                                                                                                      Entropy (8bit):5.56027315793963
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:kw2mk47cpeTiUA2JlkubkAtj/nkgBgaNfNl:cmkccpEFJHlgcH
                                                                                                                                                                                      MD5:0EC4E905D0D70F6E86F8AD73DD13828A
                                                                                                                                                                                      SHA1:E31882864E7E6FE8AF8E61002E40E1865893413B
                                                                                                                                                                                      SHA-256:A57115DA8DFE7EA6307D78BE177069B1019C556504B6599232D26BFBBFDD1B6C
                                                                                                                                                                                      SHA-512:C3C67E48032C86F1FFAEB31CA350E3DD227651A51446E9598A2E3C660A5E6220F39BA74E23B832B7D006043B7D104BF3F4F49A2CC89AF1F289FCD8E8B7311458
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:"https://www.gstatic.com/_/boq-play/_/js/k=boq-play.PlayStoreUi.en_US.lvOGIVkP2jw.2021.O/ck=boq-play.PlayStoreUi.Y1yArtXW1Kk.L.B1.O/am=R7cZwOj6QDAJDPAPHgdjAQ/d=1/exm=A1yn5d,A7fCU,ArluEf,BBI74,BVgquf,BfdUQc,C7e1Kc,C7s1K,CKm2Wb,CvxVpd,DRmmld,EEDORb,EFQ78c,ElYdAc,FoxcOd,FuzVxc,GjTCAc,GkRiKb,I8lFqf,IJGqxf,IZT63,IcVnM,J22eF,JH2zc,JNoxi,JWUKXe,KUM7Z,Kfp2G,L1AAkb,LCkxpb,LEikZe,LRovxc,LcQwud,Lkzi5d,M2Qezd,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NkbkFd,NkwaS,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PAQZbb,PHUIyb,PRm2u,PZ1hre,PrPYRd,QIhFr,RBsfwb,RMhBfe,RQJprf,RjJvI,RqjULd,SWD8cc,SdcwHb,SpsfSb,UINLVc,ULFnWe,UUJqVe,UZStuc,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,WO9ee,XVMNvd,Y413Bc,YTx6oe,Z5uLle,Z5wzge,ZDZcre,ZMKy0d,ZfAoz,ZwDk9d,_b,_tp,aTwUve,aW3pY,aurFic,byfTOb,chfSwc,dZ05Qb,dfkSTe,e3Zld,e5qFLc,ebZ3mb,fI4Vwc,fKUV3e,fPcQoe,fdeHmf,fl2Zj,g6aYuf,gKWqec,grWkAb,gychg,hKSk3e,hc6Ubd,iAQMie,iLGjNb,indMcf,j9sf1,jX6UVc,jZ2Ncd,kJXwXb,kWgXee,kdbckd,kjKdXe,kpVlPe,kr6Nlf,lDZ2Fb,lazG7b,lpwuxb,lsjVmc,lwddkf,m9oV,mI3LFb,mdR7q,mmmrlc,mzLjxc,n73qwf,nKuFpb,oEJvKc,ovKuLd,pCKBF,pQUyNd,pYCIec,pjICDe,pw70Gc,q0xTif,qczJ2b,qfGEyb,qk5AGd,qqarmf,qyd4Kb,rpbmN,s39S4,sJhETb,sOXFj,soHxf,t1sulf,tBvKNb,tKHFxf,vNKqzc,vrGZEc,w08zce,w9hDv,wW2D8b,wg1P6b,ws9Tlc,xI1uef,xQtZb,xUdipf,xii62b,yDVVkb,yNB6me,ywOR5c,z5Gxfe,zBPctc,zbML3c,zr1jrb/excm=_b,_tp,appdetailsview/ed=1/wt=2/ujg=1/rs=AB1caFUV8UP3ddtjdqvbKn05ZG9gzwvc3g/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Hs0fpd:jLUKge;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;Rdd4dc:WXw8B;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;nAu0tf:z5Gxfe;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;sgjhQc:bQAegc;wR5FRb:O1Gjze;xqZiqf:BBI74;yEQyxe:TLjaTd;yxTchf:KUM7Z;zxnPse:GkRiKb/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                                                                                                                                                      Preview:"use strict";this.default_PlayStoreUi=this.default_PlayStoreUi||{};(function(_){var window=this;.try{._.u("Wt6vjf");.var tdb=class extends _.z{constructor(a){super(a,0,tdb.le)}tc(){return _.dh(this,1)}nf(a){return _.zh(this,1,a)}};tdb.le="f.bo";var udb=function(a){a.jI&&(window.clearTimeout(a.jI),a.jI=0)},vdb=function(a){const b=_.YK.get(window.location.protocol=="https:"?"SAPISID":"APISID","");a.JG=a.ME!==""&&b==="";a.DO=a.ME!=b;a.ME=b},xdb=function(a){a.aA=!0;const b=wdb(a);let c="rt=r&f_uid="+encodeURIComponent(String(a.bJ));_.Ek(b,(0,_.Ze)(a.O,a),"POST",c)},QL=function(a){if(a.wM||a.aA)udb(a),a.jI=window.setTimeout((0,_.Ze)(a.H,a),Math.max(3,a.SE)*1E3)},wdb=function(a){const b=new _.Xn(a.HV);a.TJ!=null&&_.io(b,"authuser",a.TJ);return b},.ydb=function(a){a.JG||(a.aA=!0,a.SE=Math.min((a.SE||3)*2,60),QL(a))},zdb=class extends _.Vj{xd(){this.wM=!1;udb(this);super.xd()}H(){vdb(this);if(this.aA)return xdb(this),!1;if(!this.DO)return QL(this),!0;this.dispatchEvent("p");if(!this.bJ)return

                                                                                                                                                                                      Chrome Cache Entry: 637

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):37658
                                                                                                                                                                                      Entropy (8bit):7.994897732347311
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:TcLp/YW4i3iSAv1E9R6rYhOsr+yP/xImd8BIB01iP8mks18VK4y5:AGsFAvwgrjYNPqmhua0K46
                                                                                                                                                                                      MD5:7090B63ACBEC7EE45513BDDC66AD4830
                                                                                                                                                                                      SHA1:08DC4311CA095FEA0628CC8A8123DE300C6F084D
                                                                                                                                                                                      SHA-256:41799BFEFFBEFD1B0A4EFC6AFB98EB7BCFC96319A00DC81A9896942738ADDC2B
                                                                                                                                                                                      SHA-512:59CDDAFDFE470FBAE2D08B1DEADADA9CAAAAC576B5E06797A82E4B65FADCE9B845EB9F89F87FBCB632E39AD79774B939E16D710D145769AE3726F8BEF663C6C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/2NIrHlIy9Hv3L-m6d1y5dJjZb65Vk_ILqCrqEZdcYvIQLNblByZkY1UIv5_v41sC7Ro=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."..j.@.D.5x.C....#. DH..3,..g.. ...>p....>..k...|W./5.......W.............../..'......J~...{..........o....._..z=.?......Y...%...k....?./l................4?U.s..w...q.S./7}.}#..........!.#......}..._..............{......?....9.#...............}d.C.............?........?./.............O............#.....?n..}K...............E.g......g.....?._.??.;.0|..Uy..m.u.W..{..9"c...sl....(..&....N..f.....X.rXu.L?m.Z.z......bt.sO.R.9......;...K=[Q?...e...T=z)..D/..L6..Z.........X5Y..1...ir}.T../.,J.F..Z..x,;..YZ...,...\.d4..}...n...s....(...z...D.G.j.Qo..0...u.%Zp......K.......!..(..Ew...S...)EVP.*].....y[..!.K5.Y ..T....'....G...`.h....4.z.d.5[<.".#.#...;..#.y.....f....c.....ZW..."...U..#....\<n?.{b....{..qQ..B.'.O$v...L$^h.U..........Rc...6....^4EwC.`>r2.C%.oBL|eG....[.Z..F.e.....ov.J.[O.\..Q".....!..5.....3../A.k./X.:L..5..e2....?%...?/e...,...D.IJ..gs....z.............P$.Jw..T.......ra..).../.._f8.h.\....

                                                                                                                                                                                      Chrome Cache Entry: 638

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):34736
                                                                                                                                                                                      Entropy (8bit):7.994831968088191
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:03n7+TtVLG50DX3C0/P+0/hCstO05hP4qK65YgFrXLfBBUmBo:037MeKX3n+8g05VsDgFrXLfwoo
                                                                                                                                                                                      MD5:9F6E8DDF058E07392417009FB91BB655
                                                                                                                                                                                      SHA1:B97A6FD4756779522EE7E1098276478E8EC29E3B
                                                                                                                                                                                      SHA-256:E8ECF31ECAA90B199C1785ABF0FC22B6582081378CB23BF5BB3CEE5C4357866A
                                                                                                                                                                                      SHA-512:8FC862162CA1FD8531B4D8CE4DC22346DED71B13A75B3AA44BC2ADE88AE90A2E18954AD99EC383AC49B411E4B3233803FECE2C8C6941DD35D85502901D7B67A2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 .........*..(.>](.E....+.;p...di....a...~.Y+.i..?3=.../.~...........n=5........^.Z.....m.........c...'.........?..j............{.G.k..?.?..............?..g....._._7.....~p...?....T.....S.'....U..w....z../._..5...........<?{.S....././...........`?..........u.....?......k........^o...?t?.......?.b...a....LAs....a.ed.. ..9.[x+qt..#...MP..4X.M.L.`\{.vs..........dz.2.Sq.......L..).ciu....Q..b....L."{...4.j..[Rx...d.6...H....^....n..$*=..f~..(].s.....h.[......J...#...Ro...t..-@....D..c.N+3.....L..@.b..R.aP..b}..]C.yZ..6C".......]3...)YJM..L.q.|..ydc.'.....f.o+1F2...m\hS@.r.j...`n.Ou.V.. d.o.x.vfLht....5H....;6..1.7.xy0.;>...B._VB...K.}W[..*=.d.Z.......W..&...p.+...'.7. ...9S+5.G.....j....T..o....@.CY.-...".....~u...7........^....Ig.......u.....SF[....B..p=w...1]..\7c.......j..>....(.TL........A{...f.;...a..D9..i}.. ..&.1.iCS=Z...+9...X....c4L.....0....0.y.F........&..rN..Q4...F*...)Sl..N.d...!@........p.....F..X..S.x....s..}...$..`

                                                                                                                                                                                      Chrome Cache Entry: 639

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):38212
                                                                                                                                                                                      Entropy (8bit):7.993997570128572
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:QB80RJjSBRg8+aPUNJroK5d+rF8hooqnGdAjkyJb01PFj1s:QB8wqGPpPrpo8hooqGcJbWY
                                                                                                                                                                                      MD5:83AC4CAE8240E1782435213A15B04A1C
                                                                                                                                                                                      SHA1:0A3499F2FC4D410A0B945F77380A76078511D4EE
                                                                                                                                                                                      SHA-256:986500DA5D603A6BAA9E89BE92EBB023231B9B2CDB305D567F715FF1A26FD94B
                                                                                                                                                                                      SHA-512:CF22A837F51964B35F07121E92AA8A5540B67B0F880C7A4EBC1F571F01EDAC950E8D59FB0AB02A0396183753372A4C352589776BB1F3848B3889DA9050419A28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/h7i2AB5mAOIewSd_tKpm0op0-oYAdJjNeXTCnoC8eJ_hWg0fKyUt6FGF8W-mnOQCOxo=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF<...WEBPVP8 0........*..(.>e(.E."....<.p..fm..+..?.VW....w.~..I./Z..............._..w.......V..........?.O...O...............w._eO.?......L.}.#...s......_k......=...t;.......?....]..k..z....'.............O.~z.......o......P..^.........]....../...........O......;.........../....~.}D.........ot.Y...U...........?...~....}.y....K....'.f..~.|.Q...8...rM..Nz..e...e#JJ...i..Eu.`.v..1.....P-..1>5.|...+...$.<W..F.`.'..T......%.....9...)Ry.c<DlD..3.....~.j.....~.z.l......`.Y......ii.Ot...........v..G....."W.p...........r...jA..........8...G......<..O.#7....G..w.....G.=..".+....r.C..5..+.......E.U0.......6{#+.....M..3^k.w.;|.z.....c.<..z.y.........=......O.;/...".\3 ..A..F9.M.c..(3..#.U..5.....i...].3W,..p.xx....>6.[.....q..:)T.f%x.^....V..^mm .}.V)..l.kb.]...@"...'....D.5....o....B.Y.......uu...A/..9:({.(.c.,..C..,.G!.$~=...m\.k...h.O........*.Y...6Zo".^..Sz;.D..r.....z....3M...&.N&8......#{...u.rs..^......()V.G.........0..C.n..e.....'u

                                                                                                                                                                                      Chrome Cache Entry: 640

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2384
                                                                                                                                                                                      Entropy (8bit):7.880658109187703
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Jp6H3I0OrX7lZUZ3B2E5/biWjWMO46Juzt3w+EE68jNFJkGKLs0N5:JwH4LXRZeLl/nlhEMdKr5
                                                                                                                                                                                      MD5:0DB283C140AF9F4D5EA510AFCA8BD788
                                                                                                                                                                                      SHA1:527E38AB7AD2D058C71357591EF770490748FFBB
                                                                                                                                                                                      SHA-256:93DA6A2392F4627DF5597D9568B72718D7474F35FCD6DF6D1C1799551DF3AA7D
                                                                                                                                                                                      SHA-512:48622B3856CDD202B7B8D444F915FA8DD2186C0EB4243F33502D44954136CFD051CEC66D50D1822A090F14954FF2B76199E15BA61F935F72EDB56EF32F54653B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFFH...WEBPVP8X........)..S..ALPHT....w`6..R.(S.b.....<.5..&..8-C.iA..`.....f5.'........O.f..GNB.6....D...?.PA.5$.dm.._.VP8 ....P1...**.T.>)..C!.!..4......p...n.d........W............W.}...~.v.x.....|..P.'.o....?....W...?._.%?0}X?.<O.....O..g...Y.S...;..D.Q..>.?..'...c.w....}..W.........s?.} ........._h...b.k.....?.'.....?.............^..........!?......pj....6.(....(.$&...u........U..P.e.<f.....-./*..(..M...../..'u..E..0.4f.IN..J..w.......[....S.J!).o.f..F...~...#e..@.....~.?..X...[PP.ACY.e%.......!?..........s.'.[k...#..%v<?.L..(...$o........_.........\..9.../....U.i..M..F..T.Z..h-V[j...jX.;..C....VC}Y.6...`.R%...0..MX.[!.......fU.\..!....2(Zy..........p[..)>..\.4F..4.-..}..~....A=0.....w.j..a.Q..dB+.fG9......yTo...{.NAh.N'4.R...8..L|=d..{.S..yK.,.S;..V.Au..K.....l.l.%.?...<.Q........4...(.cb.N...a...]...>;.|.^...`.J...hp..F.<..Wve.OD....8p...g..G..r.,<.%(...w....!....$.=...P.........{.d....e....[vu8.T7'.x...%'..i..9!.Y...i.......uX,p+....w..[.

                                                                                                                                                                                      Chrome Cache Entry: 641

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (2358)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14976
                                                                                                                                                                                      Entropy (8bit):5.67171302650422
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:2Aj57nSJyC9lHwO0Bx2Ckwlf6VrI3dq15N2ap3NRI3X3ZA7shBa2SuS:NC9lHwO0X2CdJ6Edq15NRp3XgXp84a/9
                                                                                                                                                                                      MD5:55CFC6704F3C35CFF76887CEF7BEE0FC
                                                                                                                                                                                      SHA1:579FDF296ACAF8CFB8AE85989E17FE22995307A9
                                                                                                                                                                                      SHA-256:55043EC5593C1CF298833F161641877C8E2BBD5F3F026B95717EF4D1E40A3B18
                                                                                                                                                                                      SHA-512:1E5BADE819038B35A8FC6045D7139A2F0080BE5EC9BBE2C0DA7DF33A8628D22223D44293F44EED2BEA449518373352D5B5DAE822B37B05C5FA666674F7682AC0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:"use strict";_F_installCss(".YALzif{background-color:black;height:100%;left:0;position:absolute;top:0;width:100%}@media screen and (min-width:840px){.YALzif{display:block;height:480px;position:relative;width:853px}}.wnr67e{display:block;height:100%;overflow:scroll}.Q0klLb{background-color:black;height:180px;width:320px}.nFP0jc{left:0;margin-top:20px;overflow-y:hidden;width:320px}.tqorv{align-items:center;border-bottom:1px solid grey;color:white;display:flex;padding:24px 16px}.jKAqf{max-height:406px;overflow-y:scroll;padding-top:16px}.lKf3F{align-items:center;border-radius:8px;display:flex;height:80px;margin-bottom:4px;padding:16px;position:relative}.Jamhv{bottom:0;height:100%;position:absolute;right:0;width:100%}.lKf3F:hover{background-color:rgba(60,64,67,.5)}.vbwGKc{border-radius:8px;height:48px;width:48px}.o1lVq{font-size:1rem;font-weight:400;letter-spacing:.00625em;line-height:1.5rem;font-weight:500;letter-spacing:.25px}.nK64Q{margin-right:8px;height:40px;width:40px}.ZcwU1{font-weig

                                                                                                                                                                                      Chrome Cache Entry: 642

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (65284)
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):140929
                                                                                                                                                                                      Entropy (8bit):5.21374304277125
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:MOgAc1fFOszeCOG3RxCK8Yi/Glq+dBZDUiOMRLMGpukRRgj8evHgZsUgeAq5qV8h:uQCL7ji/udoxKRRtYHgZsUgeAq5qOsJu
                                                                                                                                                                                      MD5:10AD6473484630A85272174DE546FA21
                                                                                                                                                                                      SHA1:EA40634DC07BE2074345CDC14F6844D3CF3F02BD
                                                                                                                                                                                      SHA-256:36231D9CCBF4581029B3733C99C07B587CE56A7113B74AE7C0C0A083AEC38029
                                                                                                                                                                                      SHA-512:547B0D695D42E176E02927363B4AD90E69143A130A3E0FEB222F1A6D7F6A4DA543CD5267AC31871672E70A7B8F999DDC362D674099BE7F326D05B654F72442C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/swiper/js/swiper.min.js
                                                                                                                                                                                      Preview:/**. * Swiper 5.4.5. * Most modern mobile touch slider and framework with hardware accelerated transitions. * http://swiperjs.com. *. * Copyright 2014-2020 Vladimir Kharlampidi. *. * Released under the MIT License. *. * Released on: June 16, 2020. */..!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).Swiper=t()}(this,(function(){"use strict";function e(e){return null!==e&&"object"==typeof e&&"constructor"in e&&e.constructor===Object}function t(i,s){void 0===i&&(i={}),void 0===s&&(s={}),Object.keys(s).forEach((function(a){void 0===i[a]?i[a]=s[a]:e(s[a])&&e(i[a])&&Object.keys(s[a]).length>0&&t(i[a],s[a])}))}var i="undefined"!=typeof document?document:{},s={body:{},addEventListener:function(){},removeEventListener:function(){},activeElement:{blur:function(){},nodeName:""},querySelector:function(){return null},querySelectorAll:function(){return[]},getElementById:function(){return null},createEv

                                                                                                                                                                                      Chrome Cache Entry: 643

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (1618), with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1618
                                                                                                                                                                                      Entropy (8bit):5.781837534694755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:VKEcJHxKo7LmvtUjPKtXsNEHFmc8s1aiRLrwUnG:fSHgj5c+HFbHv5suG
                                                                                                                                                                                      MD5:94943530E104EE3F88D6AD86638B28C3
                                                                                                                                                                                      SHA1:B8B7F7556523E03B5519338B59AE8D998987D457
                                                                                                                                                                                      SHA-256:2538181A77FD5AEA93113400E39EBA98728EAC1FC13057F0B40C9AAE69054EA1
                                                                                                                                                                                      SHA-512:5031C94E34477D67FAC9002DE62BB81CB359B16B59FAD19EB63CB1221ADFC275AC956F25580BBCA5D5F829FCBAAA4161F59302C584635E8D30217D3492F5D4D1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]||{},N='grecaptcha';var gr=w[N]=w[N]||{};gr.ready=gr.ready||function(f){(cfg['fns']=cfg['fns']||[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']||[]).push('6LcA2tEZAAAAAJj7FTYTF9cZ4NL3ShgBCBfkWov0');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!

                                                                                                                                                                                      Chrome Cache Entry: 644

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (26053), with no line terminators
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):26053
                                                                                                                                                                                      Entropy (8bit):4.509117644614597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:CMJihoCcZCOud8G8tKS65wqsZQ1G+dM2cl6iCRotsV84sxIKcv4g01UeEPEQEB4D:CMJihoCcZCOud8G8tKS65wqsZCG+dM25
                                                                                                                                                                                      MD5:847DA8FCA8060CA1A70F976AAB1210B9
                                                                                                                                                                                      SHA1:0557D37454B67F42F2CB101E57E5070FB1193570
                                                                                                                                                                                      SHA-256:1AA8845FD06E475AEFE733D4E55B36A92FCD487975049C8172341827AC9CC03E
                                                                                                                                                                                      SHA-512:D5C2BBF1AD68FA1B7625C696EA0F0E5D8C2AA5EBFDFBA1AA3A4CFDC6604DF625148489DD2ADC7020B19660E4A26CE2A32EC11D8F28D9BD80EAFDC67035E6A4D3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://www.neat-reader.com/express/vendor/aos/aos.css
                                                                                                                                                                                      Preview:[data-aos][data-aos][data-aos-duration="50"],body[data-aos-duration="50"] [data-aos]{transition-duration:50ms}[data-aos][data-aos][data-aos-delay="50"],body[data-aos-delay="50"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="50"].aos-animate,body[data-aos-delay="50"] [data-aos].aos-animate{transition-delay:50ms}[data-aos][data-aos][data-aos-duration="100"],body[data-aos-duration="100"] [data-aos]{transition-duration:.1s}[data-aos][data-aos][data-aos-delay="100"],body[data-aos-delay="100"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="100"].aos-animate,body[data-aos-delay="100"] [data-aos].aos-animate{transition-delay:.1s}[data-aos][data-aos][data-aos-duration="150"],body[data-aos-duration="150"] [data-aos]{transition-duration:.15s}[data-aos][data-aos][data-aos-delay="150"],body[data-aos-delay="150"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="150"].aos-animate,body[data-aos-delay="150"] [data-aos].aos-animate{transition-de

                                                                                                                                                                                      Chrome Cache Entry: 645

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):39328
                                                                                                                                                                                      Entropy (8bit):7.994553634657984
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:A/WR0bD0TlgaAMvBzBy8EWlua4yrg0yPlnGMMZmXVTI8Wgc1W6:us0bohfzOWlu25qliZmFpzuR
                                                                                                                                                                                      MD5:D99582F67A3ECE0D09B9D9D540FE885A
                                                                                                                                                                                      SHA1:87DD927AD44F8A9EB59BBC13DBE8F89F5E7A2AEC
                                                                                                                                                                                      SHA-256:ABABC2F9BC320FF88E90359EBE4FADDBC51A98C35E2C5783CCF0D5872F3E0C88
                                                                                                                                                                                      SHA-512:0BE4FDC1E427AA9072290A21C19B8D0C0619DC80999FDF9C5DB5AF6B67235D38B87F8CBE817877C6AFCF7FA0774A76451D2D5F7AF7FA1A96344742FE60EEA871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ....0....*..(.>i(.E."!.[..@...6........F3=Y.t..~....O ...O....k..v.../...}......+....p.._...r=.~.z......{.....g.G.w.........{3~.....zu..|5.t.....u...........x.......S............3}....W.....'...#.....|..M..._......o}....N..W.w..j...O........./.....v.`?.?..............u.........?..o~..........._........y......l.....~....w.y......F...7^.e[..@Mhl....o...Kx.ez....D.^...Kx.'y~...=s(nr.<..{.3g.)..3.e.j.u..?h".P5J%G....v:...)`..xD.#!.H..cv.Z.Q....Y9.mF....h.-....rSX..j3...-m^..n....[......R.z.........u~....nB....!(I.S.V.x.:..=:.(..h...`.\...jE79..-$.~R.a..]m.....k./..M.....[z..4(...cvu.. .CEU.$..w*.f...f.Y.l'r.r/S.Yh..G-,.Ew~.u.*.C...]ynF.?...8.l+X2}^{p...G..2.R...........:xrHW.zU...@{.b..w...?].........-..'.....?.W.S.t..z.e....h..L.0.^....uq.Q.p z...8r.I...v3......9..K"hC?.../q....~....!Q.../..q..............5.Z....V$=...u...J`[8..;h.....l.;..W.b.{.W).W1..E.D....../...1i..}....C.).9....[y.`.....Dno..D..qC9.....E...p.*d......Z*!.p(T.

                                                                                                                                                                                      Chrome Cache Entry: 646

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2524
                                                                                                                                                                                      Entropy (8bit):7.874311886017005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:MyjhfIkszJiDh5u2k1fscvEoih8ubjtFYvOguRNnLv8dM75wu0PQ:nj9IkIJ29ifih8EtFYWgEIM75ht
                                                                                                                                                                                      MD5:D1B31F406A40F61AD7BCE8D04DAA0DDB
                                                                                                                                                                                      SHA1:C019BC02ECEF4C51F3F35EDD74F67B60F05793CA
                                                                                                                                                                                      SHA-256:47124FC3E5D9443C21C387167A58F402C38791761183013F568426401345340E
                                                                                                                                                                                      SHA-512:31C7EE003B7915B0002E3621079F5FFABBD8D02CBE96F446303A7F9A4DF7020CF778ACED1BD125A9383A47D9415B0C51E934CA435DBA563062679449DA50E1C5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........?..?..VP8L..../?.......m..?.v.BDL..b..`Z...?m....`.2CR...de.08vRX,....1..X8f.1....J/.3../.....fffH.4sw.0...f..-.a.6.Dy......F..I.....0....1.r.m;?.......TS..r.`.`...Y9.m'...B..T.2.......'oN*8...{~.ve.....m;.@&...U.J..6*.p.F."...33........R..JR...6D.....*%.QV_V.....\.a...bs.)...j....h...H7...*..}...6D.........vb<.,zW....o...8..|S...8<...%..`)'C....|._..cC.*{.'x.ER...$B$=c0.8..%.)y.$AI..+O....J38.SLU7.....9O.bffD>e....>.......f.!X...XD.f.Cy...."1....u.E..7..s0>.....xh..R..RxN..NT.`XOq.>....7..-. .....N.....=|0..W....UW.K.... .K..:e.....2P#..lT.&.X..\..|`..t....3.....X.9y.._`n.z...b.Xo...X@.(_D.!9..KD._..D..H7.XJu..#...-.r..d@R..........X.'...|{.%.9C.d..-....9x........d.C.......9'.{....O9.Qv..u............"+++...U..o..fu.\.22.3gH.RX........t.9..&.H.l.:...s0..$......f.....5........2.4.xIx........E..T".o'...O)..4.`Z0....2....pZ\4..5.............k........cL..OX.d<...0c.auV._6..4jmY3....[.UfW.X2......P_.5`GMy/.&Q.k...

                                                                                                                                                                                      Chrome Cache Entry: 647

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 526x296, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                      Size (bytes):37288
                                                                                                                                                                                      Entropy (8bit):7.994762848094783
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:768:UQSzY+QT8ixHcLcMPO0iDX5nGViyewu06tKiCMSrCgTFEbg:UQSzJQCLcMPO9X5nGViyej0dph
                                                                                                                                                                                      MD5:156C2C8098F1F956D43EF04E6FC6DFF4
                                                                                                                                                                                      SHA1:5844EF40E7C70C89F8B30E94E3EF7DE57F37BBD8
                                                                                                                                                                                      SHA-256:5A79395E0FA29B172E332D0600B70A3B90D36C425421C16F514D087B50829571
                                                                                                                                                                                      SHA-512:E0722ECA4C570C68D21739F407FC18E5FC3695DA344516EDBAF226FC250F1B989B6B34C2A132D6EB95CC1FD8F04D757E277DC104931C98C988ABA495FA00DA49
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      URL:https://play-lh.googleusercontent.com/6VKnXQxCm-kEHgUk7nABc1ZEWAWNtj3XxejRdPVi_QLFzs_c9ETNcwCZV4ZamldV_dk=w526-h296-rw
                                                                                                                                                                                      Preview:RIFF....WEBPVP8 ........*..(.>e(.E."....t@.D.6..ImL....pt...}q......o.?....{..k...?.'.?...;......._.~}.?......i...../.o.G.....?.?......X.?._......_h.........~..b...........K.X......'..._.t..{....o.<..o.....%>e.i.s..............W...^...=o?........?...........}....w...............G..._..'~.?..o...W.?..._.....~...........!..?....#......7....._.......c...... ..9..;.0..S.E6.e.)....z.C...LD.*.ms..b.V..{+....K.5.....kdV..Mq$..d...X....ET.];JA.(....T9...V?L.Wm..R..V.@...0E;O....xt..b.../|..L..!..vt...To.Ol..i.T%.L....D...4.+.i....}..^.t...7..5..C....8!..}......Z....>4..8F 4..!I./r...|.H}.rLp.....1.m...G..d...f..fM.$.s...JH;&.a,.......E....T$"..W.Q..IP(m...X.....U;.6.S.Ui.z..u.......dQ..t.cd...7...u..6?..d#..7{.o.@..... N.J..i.n.4.VR..,X...A.P.}..c..S$9...Q.$i...97..a..+%.K.....0iP[.4x.<;.@..r.8V.@..JN.{H.:....4v.b._..k...A}.'....Q..Ec.,t.b.z.*d.%.L..n.?.FOao..6M.S...U~.....'.xT..+....1fh..j..v....0.......f.l....V...s...Z..>.4....._.Pv.uQ...7.$...O6.Q..

                                                                                                                                                                                      Chrome Cache Entry: 648

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3798
                                                                                                                                                                                      Entropy (8bit):7.9369350615154355
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:k+a5wwCBr36JcGiI4c0nB1/ZbFXmJKlF1xCm5nLJZ3A9Uo6DIiIw/MtPK:KwwzcO4xnB1/hsOFum5nLJZ3A9Uo6DIa
                                                                                                                                                                                      MD5:F85FD91DFE24644E8C231513F3CA8D75
                                                                                                                                                                                      SHA1:D576BA13B30AC0A01380F11D9FA492C300DB1603
                                                                                                                                                                                      SHA-256:EFBC2D113C5B188D10D125657C6E6CF969759E0422B4CC5B01583A35E2CAF2AD
                                                                                                                                                                                      SHA-512:BD43A9853316F4F4AA4C8DD92511FF924BFA6BAE9BA795F106E40450276FF3EC9818E8B00241F8B0C4F0BA8482A0DAF673949A6B1993872E3ED83354489EC772
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........)..'..ALPHb....w`6..R.(S.b.....<.5..&..(m&.O.H......PB..............5....M.+I..I............?.....G=H2FI.I.em...VP8 F...0K...**.(.>)..C!.!.L.X.....p...{...k.,.F..1.n~...z..?X:.|.uYXO._.?8..v../..!..}S.o./._....#.....?.........T.W...u....D...o.....|....n.............*.......?..{....w...w..?..i.....K.....W...........K................i...K......D.F]<.V......t.yV.(....R.-.*cC3..B...........4.....~.&.....W.?..8.w.k,(..[".%o.cy...x..A@-.5.........U.F...i........$.2...-`.Y4..?.Y..p...7)...o,..........l(.h........KX..**.2.._....@.....*..P.C".cpg.2.}...yZ....#.9.'.....&l..y..Y..l[.O.]....}.....:.3....../.]..........8P.ET.........OH..c.A1vI.0aR.....E..*...nK..O7..2...F]<.V......t.y[#..o+de...l..y....O .......PrI.?.n5......a.EO<..q..KNdA..2u......t....f.......O....B!!.a.T.-..x....LE...`9..8...I..9!*..+..D...U...(e..?3k..p.......z...... ............g...w..;7mQ....&Q.||9.3..9......H...y....HpNC2...WK+.........R.Xo..qu.......

                                                                                                                                                                                      Static File Info

                                                                                                                                                                                      ⊘No static file info

                                                                                                                                                                                      File Icon

                                                                                                                                                                                      Icon Hash:00b29a8e86828200

                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                      Statistics

                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                      Behavior

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      System Behavior

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                      Start time:14:03:29
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                                                                                                                                                                                      Imagebase:0x7ff715980000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                      Start time:14:03:33
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                      Imagebase:0x7ff715980000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                      Start time:14:03:36
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.neat-reader.com/download/start-download?target=windows"
                                                                                                                                                                                      Imagebase:0x7ff715980000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:5
                                                                                                                                                                                      Start time:14:03:46
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                      Imagebase:0x7ff715980000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                      Start time:14:04:26
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://play.google.com/store/apps/details?id=com.gzhi.neatreader.r2.main
                                                                                                                                                                                      Imagebase:0x7ff715980000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                      Start time:14:04:27
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,1756451637922991175,14183001203310220918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                      Imagebase:0x7ff715980000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:11
                                                                                                                                                                                      Start time:14:04:36
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6852 --field-trial-handle=2236,i,6439054695075565315,17960345864955142184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                      Imagebase:0x7ff715980000
                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                      MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                      Start time:14:04:50
                                                                                                                                                                                      Start date:28/09/2024
                                                                                                                                                                                      Path:C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe"
                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                      File size:62'455'064 bytes
                                                                                                                                                                                      MD5 hash:DEF17C832C3E8169A69D3E854193F59B
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      Disassembly

                                                                                                                                                                                      Reset < >

                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                        Execution Coverage:7.8%
                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                        Signature Coverage:16.8%
                                                                                                                                                                                        Total number of Nodes:1217
                                                                                                                                                                                        Total number of Limit Nodes:62
                                                                                                                                                                                        execution_graph 8271 401941 8272 401943 8271->8272 8277 402c41 8272->8277 8278 402c4d 8277->8278 8322 4062dc 8278->8322 8281 401948 8283 4059cc 8281->8283 8364 405c97 8283->8364 8286 4059f4 DeleteFileW 8288 401951 8286->8288 8287 405a0b 8289 405b36 8287->8289 8378 4062ba lstrcpynW 8287->8378 8289->8288 8407 4065fd FindFirstFileW 8289->8407 8291 405a31 8292 405a44 8291->8292 8293 405a37 lstrcatW 8291->8293 8379 405bdb lstrlenW 8292->8379 8295 405a4a 8293->8295 8298 405a5a lstrcatW 8295->8298 8299 405a65 lstrlenW FindFirstFileW 8295->8299 8298->8299 8301 405b2b 8299->8301 8303 405a87 8299->8303 8300 405b54 8410 405b8f lstrlenW CharPrevW 8300->8410 8301->8289 8305 405b0e FindNextFileW 8303->8305 8315 4059cc 60 API calls 8303->8315 8317 405322 24 API calls 8303->8317 8383 4062ba lstrcpynW 8303->8383 8384 405984 8303->8384 8392 405322 8303->8392 8403 406080 MoveFileExW 8303->8403 8305->8303 8309 405b24 FindClose 8305->8309 8306 405984 5 API calls 8308 405b66 8306->8308 8310 405b80 8308->8310 8311 405b6a 8308->8311 8309->8301 8313 405322 24 API calls 8310->8313 8311->8288 8314 405322 24 API calls 8311->8314 8313->8288 8316 405b77 8314->8316 8315->8303 8318 406080 36 API calls 8316->8318 8317->8305 8320 405b7e 8318->8320 8320->8288 8336 4062e9 8322->8336 8323 406534 8324 402c6e 8323->8324 8355 4062ba lstrcpynW 8323->8355 8324->8281 8339 40654e 8324->8339 8326 406502 lstrlenW 8326->8336 8327 4062dc 10 API calls 8327->8326 8330 406417 GetSystemDirectoryW 8330->8336 8332 40642a GetWindowsDirectoryW 8332->8336 8333 40654e 5 API calls 8333->8336 8334 4062dc 10 API calls 8334->8336 8335 4064a5 lstrcatW 8335->8336 8336->8323 8336->8326 8336->8327 8336->8330 8336->8332 8336->8333 8336->8334 8336->8335 8337 40645e SHGetSpecialFolderLocation 8336->8337 8348 406188 8336->8348 8353 406201 wsprintfW 8336->8353 8354 4062ba lstrcpynW 8336->8354 8337->8336 8338 406476 SHGetPathFromIDListW CoTaskMemFree 8337->8338 8338->8336 8345 40655b 8339->8345 8340 4065d1 8341 4065d6 CharPrevW 8340->8341 8343 4065f7 8340->8343 8341->8340 8342 4065c4 CharNextW 8342->8340 8342->8345 8343->8281 8345->8340 8345->8342 8346 4065b0 CharNextW 8345->8346 8347 4065bf CharNextW 8345->8347 8360 405bbc 8345->8360 8346->8345 8347->8342 8356 406127 8348->8356 8351 4061ec 8351->8336 8352 4061bc RegQueryValueExW RegCloseKey 8352->8351 8353->8336 8354->8336 8355->8324 8357 406136 8356->8357 8358 40613a 8357->8358 8359 40613f RegOpenKeyExW 8357->8359 8358->8351 8358->8352 8359->8358 8361 405bc2 8360->8361 8362 405bd8 8361->8362 8363 405bc9 CharNextW 8361->8363 8362->8345 8363->8361 8413 4062ba lstrcpynW 8364->8413 8366 405ca8 8414 405c3a CharNextW CharNextW 8366->8414 8369 4059ec 8369->8286 8369->8287 8370 40654e 5 API calls 8376 405cbe 8370->8376 8371 405cef lstrlenW 8372 405cfa 8371->8372 8371->8376 8374 405b8f 3 API calls 8372->8374 8373 4065fd 2 API calls 8373->8376 8375 405cff GetFileAttributesW 8374->8375 8375->8369 8376->8369 8376->8371 8376->8373 8377 405bdb 2 API calls 8376->8377 8377->8371 8378->8291 8380 405be9 8379->8380 8381 405bfb 8380->8381 8382 405bef CharPrevW 8380->8382 8381->8295 8382->8380 8382->8381 8383->8303 8420 405d8b GetFileAttributesW 8384->8420 8387 4059b1 8387->8303 8388 4059a7 DeleteFileW 8390 4059ad 8388->8390 8389 40599f RemoveDirectoryW 8389->8390 8390->8387 8391 4059bd SetFileAttributesW 8390->8391 8391->8387 8393 40533d 8392->8393 8394 4053df 8392->8394 8395 405359 lstrlenW 8393->8395 8396 4062dc 17 API calls 8393->8396 8394->8303 8397 405382 8395->8397 8398 405367 lstrlenW 8395->8398 8396->8395 8399 405395 8397->8399 8400 405388 SetWindowTextW 8397->8400 8398->8394 8401 405379 lstrcatW 8398->8401 8399->8394 8402 40539b SendMessageW SendMessageW SendMessageW 8399->8402 8400->8399 8401->8397 8402->8394 8404 406094 8403->8404 8406 4060a1 8403->8406 8423 405f06 8404->8423 8406->8303 8408 406613 FindClose 8407->8408 8409 405b50 8407->8409 8408->8409 8409->8288 8409->8300 8411 405b5a 8410->8411 8412 405bab lstrcatW 8410->8412 8411->8306 8412->8411 8413->8366 8415 405c57 8414->8415 8418 405c69 8414->8418 8416 405c64 CharNextW 8415->8416 8415->8418 8419 405c8d 8416->8419 8417 405bbc CharNextW 8417->8418 8418->8417 8418->8419 8419->8369 8419->8370 8421 405990 8420->8421 8422 405d9d SetFileAttributesW 8420->8422 8421->8387 8421->8388 8421->8389 8422->8421 8424 405f36 8423->8424 8425 405f5c GetShortPathNameW 8423->8425 8450 405db0 GetFileAttributesW CreateFileW 8424->8450 8427 405f71 8425->8427 8428 40607b 8425->8428 8427->8428 8430 405f79 wsprintfA 8427->8430 8428->8406 8429 405f40 CloseHandle GetShortPathNameW 8429->8428 8431 405f54 8429->8431 8432 4062dc 17 API calls 8430->8432 8431->8425 8431->8428 8433 405fa1 8432->8433 8451 405db0 GetFileAttributesW CreateFileW 8433->8451 8435 405fae 8435->8428 8436 405fbd GetFileSize GlobalAlloc 8435->8436 8437 406074 CloseHandle 8436->8437 8438 405fdf 8436->8438 8437->8428 8452 405e33 ReadFile 8438->8452 8443 406012 8445 405d15 4 API calls 8443->8445 8444 405ffe lstrcpyA 8446 406020 8444->8446 8445->8446 8447 406057 SetFilePointer 8446->8447 8459 405e62 WriteFile 8447->8459 8450->8429 8451->8435 8453 405e51 8452->8453 8453->8437 8454 405d15 lstrlenA 8453->8454 8455 405d56 lstrlenA 8454->8455 8456 405d5e 8455->8456 8457 405d2f lstrcmpiA 8455->8457 8456->8443 8456->8444 8457->8456 8458 405d4d CharNextA 8457->8458 8458->8455 8460 405e80 GlobalFree 8459->8460 8460->8437 8587 6f902993 8588 6f9029e3 8587->8588 8589 6f9029a3 VirtualProtect 8587->8589 8589->8588 8607 401e49 8615 402c1f 8607->8615 8609 401e4f 8610 402c1f 17 API calls 8609->8610 8611 401e5b 8610->8611 8612 401e72 EnableWindow 8611->8612 8613 401e67 ShowWindow 8611->8613 8614 402ac5 8612->8614 8613->8614 8616 4062dc 17 API calls 8615->8616 8617 402c34 8616->8617 8617->8609 9425 403d58 9426 403d70 9425->9426 9427 403eab 9425->9427 9426->9427 9430 403d7c 9426->9430 9428 403efc 9427->9428 9429 403ebc GetDlgItem GetDlgItem 9427->9429 9434 403f56 9428->9434 9442 401389 2 API calls 9428->9442 9433 404231 18 API calls 9429->9433 9431 403d87 SetWindowPos 9430->9431 9432 403d9a 9430->9432 9431->9432 9435 403db7 9432->9435 9436 403d9f ShowWindow 9432->9436 9437 403ee6 SetClassLongW 9433->9437 9438 40427d SendMessageW 9434->9438 9456 403ea6 9434->9456 9439 403dd9 9435->9439 9440 403dbf DestroyWindow 9435->9440 9436->9435 9441 40140b 2 API calls 9437->9441 9465 403f68 9438->9465 9443 403dde SetWindowLongW 9439->9443 9444 403def 9439->9444 9495 4041ba 9440->9495 9441->9428 9445 403f2e 9442->9445 9443->9456 9448 403e98 9444->9448 9449 403dfb GetDlgItem 9444->9449 9445->9434 9450 403f32 SendMessageW 9445->9450 9446 40140b 2 API calls 9446->9465 9447 4041bc DestroyWindow EndDialog 9447->9495 9454 404298 8 API calls 9448->9454 9452 403e2b 9449->9452 9453 403e0e SendMessageW IsWindowEnabled 9449->9453 9450->9456 9451 4041eb ShowWindow 9451->9456 9457 403e38 9452->9457 9458 403e4b 9452->9458 9459 403e7f SendMessageW 9452->9459 9468 403e30 9452->9468 9453->9452 9453->9456 9454->9456 9455 4062dc 17 API calls 9455->9465 9457->9459 9457->9468 9462 403e53 9458->9462 9463 403e68 9458->9463 9459->9448 9460 40420a SendMessageW 9464 403e66 9460->9464 9461 404231 18 API calls 9461->9465 9466 40140b 2 API calls 9462->9466 9467 40140b 2 API calls 9463->9467 9464->9448 9465->9446 9465->9447 9465->9455 9465->9456 9465->9461 9470 404231 18 API calls 9465->9470 9486 4040fc DestroyWindow 9465->9486 9466->9468 9469 403e6f 9467->9469 9468->9460 9469->9448 9469->9468 9471 403fe3 GetDlgItem 9470->9471 9472 404000 ShowWindow KiUserCallbackDispatcher 9471->9472 9473 403ff8 9471->9473 9496 404253 KiUserCallbackDispatcher 9472->9496 9473->9472 9475 40402a EnableWindow 9478 40403e 9475->9478 9476 404043 GetSystemMenu EnableMenuItem SendMessageW 9477 404073 SendMessageW 9476->9477 9476->9478 9477->9478 9478->9476 9480 403d39 18 API calls 9478->9480 9497 404266 SendMessageW 9478->9497 9498 4062ba lstrcpynW 9478->9498 9480->9478 9482 4040a2 lstrlenW 9483 4062dc 17 API calls 9482->9483 9484 4040b8 SetWindowTextW 9483->9484 9485 401389 2 API calls 9484->9485 9485->9465 9487 404116 CreateDialogParamW 9486->9487 9486->9495 9488 404149 9487->9488 9487->9495 9489 404231 18 API calls 9488->9489 9490 404154 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 9489->9490 9491 401389 2 API calls 9490->9491 9492 40419a 9491->9492 9492->9456 9493 4041a2 ShowWindow 9492->9493 9494 40427d SendMessageW 9493->9494 9494->9495 9495->9451 9495->9456 9496->9475 9497->9478 9498->9482 9734 401f58 9735 402c41 17 API calls 9734->9735 9736 401f5f 9735->9736 9737 4065fd 2 API calls 9736->9737 9738 401f65 9737->9738 9739 401f76 9738->9739 9741 406201 wsprintfW 9738->9741 9741->9739 9499 402259 9500 402c41 17 API calls 9499->9500 9501 40225f 9500->9501 9502 402c41 17 API calls 9501->9502 9503 402268 9502->9503 9504 402c41 17 API calls 9503->9504 9505 402271 9504->9505 9506 4065fd 2 API calls 9505->9506 9507 40227a 9506->9507 9508 40228b lstrlenW lstrlenW 9507->9508 9513 40227e 9507->9513 9510 405322 24 API calls 9508->9510 9509 405322 24 API calls 9512 402286 9509->9512 9511 4022c9 SHFileOperationW 9510->9511 9511->9512 9511->9513 9513->9509 9513->9512 9514 40175c 9515 402c41 17 API calls 9514->9515 9516 401763 9515->9516 9517 405ddf 2 API calls 9516->9517 9518 40176a 9517->9518 9519 405ddf 2 API calls 9518->9519 9519->9518 8461 405461 8462 405482 GetDlgItem GetDlgItem GetDlgItem 8461->8462 8463 40560b 8461->8463 8507 404266 SendMessageW 8462->8507 8465 405614 GetDlgItem CreateThread CloseHandle 8463->8465 8466 40563c 8463->8466 8465->8466 8530 4053f5 OleInitialize 8465->8530 8468 405667 8466->8468 8471 405653 ShowWindow ShowWindow 8466->8471 8472 40568c 8466->8472 8467 4054f2 8476 4054f9 GetClientRect GetSystemMetrics SendMessageW SendMessageW 8467->8476 8469 405673 8468->8469 8470 4056c7 8468->8470 8473 4056a1 ShowWindow 8469->8473 8474 40567b 8469->8474 8470->8472 8483 4056d5 SendMessageW 8470->8483 8512 404266 SendMessageW 8471->8512 8516 404298 8472->8516 8479 4056c1 8473->8479 8480 4056b3 8473->8480 8513 40420a 8474->8513 8481 405567 8476->8481 8482 40554b SendMessageW SendMessageW 8476->8482 8485 40420a SendMessageW 8479->8485 8484 405322 24 API calls 8480->8484 8486 40557a 8481->8486 8487 40556c SendMessageW 8481->8487 8482->8481 8488 40569a 8483->8488 8489 4056ee CreatePopupMenu 8483->8489 8484->8479 8485->8470 8508 404231 8486->8508 8487->8486 8490 4062dc 17 API calls 8489->8490 8492 4056fe AppendMenuW 8490->8492 8494 40571b GetWindowRect 8492->8494 8495 40572e TrackPopupMenu 8492->8495 8493 40558a 8496 405593 ShowWindow 8493->8496 8497 4055c7 GetDlgItem SendMessageW 8493->8497 8494->8495 8495->8488 8498 405749 8495->8498 8499 4055b6 8496->8499 8500 4055a9 ShowWindow 8496->8500 8497->8488 8501 4055ee SendMessageW SendMessageW 8497->8501 8502 405765 SendMessageW 8498->8502 8511 404266 SendMessageW 8499->8511 8500->8499 8501->8488 8502->8502 8503 405782 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 8502->8503 8505 4057a7 SendMessageW 8503->8505 8505->8505 8506 4057d0 GlobalUnlock SetClipboardData CloseClipboard 8505->8506 8506->8488 8507->8467 8509 4062dc 17 API calls 8508->8509 8510 40423c SetDlgItemTextW 8509->8510 8510->8493 8511->8497 8512->8468 8514 404211 8513->8514 8515 404217 SendMessageW 8513->8515 8514->8515 8515->8472 8517 40435b 8516->8517 8518 4042b0 GetWindowLongW 8516->8518 8517->8488 8518->8517 8519 4042c5 8518->8519 8519->8517 8520 4042f2 GetSysColor 8519->8520 8521 4042f5 8519->8521 8520->8521 8522 404305 SetBkMode 8521->8522 8523 4042fb SetTextColor 8521->8523 8524 404323 8522->8524 8525 40431d GetSysColor 8522->8525 8523->8522 8526 404334 8524->8526 8527 40432a SetBkColor 8524->8527 8525->8524 8526->8517 8528 404347 DeleteObject 8526->8528 8529 40434e CreateBrushIndirect 8526->8529 8527->8526 8528->8529 8529->8517 8537 40427d 8530->8537 8532 40427d SendMessageW 8534 405451 OleUninitialize 8532->8534 8533 405418 8536 40543f 8533->8536 8540 401389 8533->8540 8536->8532 8538 404295 8537->8538 8539 404286 SendMessageW 8537->8539 8538->8533 8539->8538 8542 401390 8540->8542 8541 4013fe 8541->8533 8542->8541 8543 4013cb MulDiv SendMessageW 8542->8543 8543->8542 9900 401563 9901 402a6b 9900->9901 9904 406201 wsprintfW 9901->9904 9903 402a70 9904->9903 9954 401968 9955 402c1f 17 API calls 9954->9955 9956 40196f 9955->9956 9957 402c1f 17 API calls 9956->9957 9958 40197c 9957->9958 9959 402c41 17 API calls 9958->9959 9960 401993 lstrlenW 9959->9960 9962 4019a4 9960->9962 9961 4019e5 9962->9961 9966 4062ba lstrcpynW 9962->9966 9964 4019d5 9964->9961 9965 4019da lstrlenW 9964->9965 9965->9961 9966->9964 8720 40176f 8721 402c41 17 API calls 8720->8721 8722 401776 8721->8722 8723 401796 8722->8723 8724 40179e 8722->8724 8779 4062ba lstrcpynW 8723->8779 8780 4062ba lstrcpynW 8724->8780 8727 40179c 8731 40654e 5 API calls 8727->8731 8728 4017a9 8729 405b8f 3 API calls 8728->8729 8730 4017af lstrcatW 8729->8730 8730->8727 8740 4017bb 8731->8740 8732 4065fd 2 API calls 8732->8740 8733 405d8b 2 API calls 8733->8740 8735 4017cd CompareFileTime 8735->8740 8736 40188d 8737 405322 24 API calls 8736->8737 8739 401897 8737->8739 8738 405322 24 API calls 8747 401879 8738->8747 8759 403116 8739->8759 8740->8732 8740->8733 8740->8735 8740->8736 8745 4062dc 17 API calls 8740->8745 8750 4062ba lstrcpynW 8740->8750 8756 401864 8740->8756 8758 405db0 GetFileAttributesW CreateFileW 8740->8758 8781 405920 8740->8781 8743 4018be SetFileTime 8744 4018d0 CloseHandle 8743->8744 8746 4018e1 8744->8746 8744->8747 8745->8740 8748 4018e6 8746->8748 8749 4018f9 8746->8749 8751 4062dc 17 API calls 8748->8751 8752 4062dc 17 API calls 8749->8752 8750->8740 8754 4018ee lstrcatW 8751->8754 8755 401901 8752->8755 8754->8755 8755->8747 8757 405920 MessageBoxIndirectW 8755->8757 8756->8738 8756->8747 8757->8747 8758->8740 8760 40312f 8759->8760 8761 40315d 8760->8761 8788 403347 SetFilePointer 8760->8788 8785 403331 8761->8785 8765 4032ca 8767 40330c 8765->8767 8772 4032ce 8765->8772 8766 40317a GetTickCount 8768 4018aa 8766->8768 8775 4031c9 8766->8775 8769 403331 ReadFile 8767->8769 8768->8743 8768->8744 8769->8768 8770 403331 ReadFile 8770->8775 8771 403331 ReadFile 8771->8772 8772->8768 8772->8771 8773 405e62 WriteFile 8772->8773 8773->8772 8774 40321f GetTickCount 8774->8775 8775->8768 8775->8770 8775->8774 8776 403244 MulDiv wsprintfW 8775->8776 8778 405e62 WriteFile 8775->8778 8777 405322 24 API calls 8776->8777 8777->8775 8778->8775 8779->8727 8780->8728 8782 405935 8781->8782 8783 405981 8782->8783 8784 405949 MessageBoxIndirectW 8782->8784 8783->8740 8784->8783 8786 405e33 ReadFile 8785->8786 8787 403168 8786->8787 8787->8765 8787->8766 8787->8768 8788->8761 10158 402576 10159 402c41 17 API calls 10158->10159 10160 40257d 10159->10160 10163 405db0 GetFileAttributesW CreateFileW 10160->10163 10162 402589 10163->10162 9345 401b77 9346 401b84 9345->9346 9347 401bc8 9345->9347 9350 401c0d 9346->9350 9355 401b9b 9346->9355 9348 401bf2 GlobalAlloc 9347->9348 9349 401bcd 9347->9349 9352 4062dc 17 API calls 9348->9352 9358 4022f7 9349->9358 9364 4062ba lstrcpynW 9349->9364 9351 4062dc 17 API calls 9350->9351 9350->9358 9354 4022f1 9351->9354 9352->9350 9354->9358 9360 405920 MessageBoxIndirectW 9354->9360 9365 4062ba lstrcpynW 9355->9365 9357 401bdf GlobalFree 9357->9358 9359 401baa 9366 4062ba lstrcpynW 9359->9366 9360->9358 9362 401bb9 9367 4062ba lstrcpynW 9362->9367 9364->9357 9365->9359 9366->9362 9367->9358 9520 6f7e1840 9521 6f7e1898 CallWindowProcW 9520->9521 9522 6f7e1852 9520->9522 9522->9521 9523 6f7e186e InvalidateRect UpdateWindow 9522->9523 9524 6f7e187d 9522->9524 9523->9524 9525 6f7e1896 9524->9525 9526 6f7e1886 InvalidateRect UpdateWindow 9524->9526 9525->9521 9526->9525 10351 40190c 10352 401943 10351->10352 10353 402c41 17 API calls 10352->10353 10354 401948 10353->10354 10355 4059cc 67 API calls 10354->10355 10356 401951 10355->10356 9531 401c1f 9532 402c1f 17 API calls 9531->9532 9533 401c26 9532->9533 9534 402c1f 17 API calls 9533->9534 9535 401c33 9534->9535 9536 401c48 9535->9536 9537 402c41 17 API calls 9535->9537 9538 401c58 9536->9538 9539 402c41 17 API calls 9536->9539 9537->9536 9540 401c63 9538->9540 9541 401caf 9538->9541 9539->9538 9543 402c1f 17 API calls 9540->9543 9542 402c41 17 API calls 9541->9542 9544 401cb4 9542->9544 9545 401c68 9543->9545 9546 402c41 17 API calls 9544->9546 9547 402c1f 17 API calls 9545->9547 9549 401cbd FindWindowExW 9546->9549 9548 401c74 9547->9548 9550 401c81 SendMessageTimeoutW 9548->9550 9551 401c9f SendMessageW 9548->9551 9552 401cdf 9549->9552 9550->9552 9551->9552 8618 6f7e1910 8619 6f7e191f SendDlgItemMessageW 8618->8619 8620 6f7e1935 CallWindowProcW 8618->8620 8619->8620 10738 6f7e2110 10739 6f7e2141 10738->10739 10742 6f7e1cd0 10739->10742 10743 6f7e1ce2 10742->10743 10751 6f7e1fc7 10742->10751 10744 6f7e1710 19 API calls 10743->10744 10745 6f7e1d1a 6 API calls 10744->10745 10746 6f7e1d83 FindWindowExW GetDlgItem 10745->10746 10747 6f7e1da0 10745->10747 10746->10747 10748 6f7e1db9 CreateThread 10747->10748 10749 6f7e1e55 10747->10749 10750 6f7e1ddc 10748->10750 10748->10751 10765 6f7e1af0 9 API calls 10748->10765 10752 6f7e1e5d CreateThread 10749->10752 10753 6f7e1e96 10749->10753 10759 6f7e1de8 Sleep 10750->10759 10760 6f7e1df2 6 API calls 10750->10760 10752->10751 10756 6f7e1e81 10752->10756 10766 6f7e1bd0 14 API calls 10752->10766 10754 6f7e1f0e 10753->10754 10755 6f7e1ea4 SetWindowLongW GetWindowPlacement GetClientRect ShowWindow SetWindowPos 10753->10755 10758 6f7e15c0 16 API calls 10754->10758 10757 6f7e1f99 SetWindowLongW SetWindowPos 10755->10757 10761 6f7e1e89 Sleep 10756->10761 10762 6f7e1e93 CloseHandle 10756->10762 10757->10751 10763 6f7e1f21 10758->10763 10759->10750 10760->10749 10761->10756 10762->10753 10763->10757 10764 6f7e1f2c 6 API calls 10763->10764 10764->10757 9119 402032 9120 402044 9119->9120 9121 4020f6 9119->9121 9122 402c41 17 API calls 9120->9122 9124 401423 24 API calls 9121->9124 9123 40204b 9122->9123 9125 402c41 17 API calls 9123->9125 9129 402250 9124->9129 9126 402054 9125->9126 9127 40206a LoadLibraryExW 9126->9127 9128 40205c GetModuleHandleW 9126->9128 9127->9121 9130 40207b 9127->9130 9128->9127 9128->9130 9143 406703 WideCharToMultiByte 9130->9143 9133 4020c5 9135 405322 24 API calls 9133->9135 9134 40208c 9136 402094 9134->9136 9137 4020ab 9134->9137 9138 40209c 9135->9138 9139 401423 24 API calls 9136->9139 9146 6f901777 9137->9146 9188 6f7021cc 9137->9188 9138->9129 9140 4020e8 FreeLibrary 9138->9140 9139->9138 9140->9129 9144 40672d GetProcAddress 9143->9144 9145 402086 9143->9145 9144->9145 9145->9133 9145->9134 9147 6f9017aa 9146->9147 9202 6f901b5f 9147->9202 9149 6f9018d6 9149->9138 9150 6f9017b1 9150->9149 9151 6f9017c2 9150->9151 9152 6f9017c9 9150->9152 9252 6f902352 9151->9252 9236 6f902394 9152->9236 9157 6f90182d 9161 6f901833 9157->9161 9162 6f90187e 9157->9162 9158 6f90180f 9265 6f902569 9158->9265 9159 6f9017f8 9171 6f9017ee 9159->9171 9262 6f902d37 9159->9262 9160 6f9017df 9164 6f9017e5 9160->9164 9170 6f9017f0 9160->9170 9284 6f9015c6 9161->9284 9168 6f902569 10 API calls 9162->9168 9164->9171 9246 6f902aac 9164->9246 9174 6f90186f 9168->9174 9169 6f901815 9276 6f9015b4 9169->9276 9256 6f902724 9170->9256 9171->9157 9171->9158 9180 6f9018c5 9174->9180 9290 6f90252c 9174->9290 9176 6f9017f6 9176->9171 9177 6f902569 10 API calls 9177->9174 9180->9149 9182 6f9018cf GlobalFree 9180->9182 9182->9149 9185 6f9018b1 9185->9180 9294 6f90153d wsprintfW 9185->9294 9186 6f9018aa FreeLibrary 9186->9185 9189 6f7021ee ??2@YAPAXI memset ??2@YAPAXI memset _wsetlocale 9188->9189 9191 6f703681 2 API calls 9189->9191 9193 6f70228c 9191->9193 9192 6f7036d0 2 API calls 9198 6f7022fe 9192->9198 9200 6f7022de 9193->9200 9325 6f6f7b30 9193->9325 9195 6f702336 9197 6f702369 9195->9197 9199 6f702358 memset ??3@YAXPAX 9195->9199 9196 6f702325 memset ??3@YAXPAX 9196->9195 9197->9138 9198->9195 9198->9196 9198->9198 9199->9197 9200->9192 9201 6f7022ad 9201->9200 9297 6f90121b GlobalAlloc 9202->9297 9204 6f901b83 9298 6f90121b GlobalAlloc 9204->9298 9206 6f901da9 GlobalFree GlobalFree GlobalFree 9207 6f901dc6 9206->9207 9222 6f901e10 9206->9222 9209 6f902192 9207->9209 9216 6f901ddb 9207->9216 9207->9222 9208 6f901c64 GlobalAlloc 9231 6f901b8e 9208->9231 9210 6f9021b4 GetModuleHandleW 9209->9210 9209->9222 9213 6f9021c5 LoadLibraryW 9210->9213 9214 6f9021da 9210->9214 9211 6f901caf lstrcpyW 9215 6f901cb9 lstrcpyW 9211->9215 9212 6f901ccd GlobalFree 9212->9231 9213->9214 9213->9222 9305 6f90161d WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 9214->9305 9215->9231 9216->9222 9301 6f90122c 9216->9301 9218 6f90222c 9220 6f902239 lstrlenW 9218->9220 9218->9222 9306 6f90161d WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 9220->9306 9221 6f902064 9304 6f90121b GlobalAlloc 9221->9304 9222->9150 9223 6f9021ec 9223->9218 9234 6f902216 GetProcAddress 9223->9234 9224 6f9020ec 9224->9222 9229 6f902134 lstrcpyW 9224->9229 9227 6f901d0b 9227->9231 9299 6f90158f GlobalSize GlobalAlloc 9227->9299 9228 6f901fa5 GlobalFree 9228->9231 9229->9222 9230 6f902253 9230->9222 9231->9206 9231->9208 9231->9211 9231->9212 9231->9215 9231->9221 9231->9222 9231->9224 9231->9227 9231->9228 9233 6f90122c 2 API calls 9231->9233 9233->9231 9234->9218 9235 6f90206d 9235->9150 9243 6f9023ac 9236->9243 9237 6f90122c GlobalAlloc lstrcpynW 9237->9243 9239 6f9024d5 GlobalFree 9242 6f9017cf 9239->9242 9239->9243 9240 6f902454 GlobalAlloc WideCharToMultiByte 9240->9239 9241 6f90247f GlobalAlloc CLSIDFromString 9241->9239 9242->9159 9242->9160 9242->9171 9243->9237 9243->9239 9243->9240 9243->9241 9245 6f90249e 9243->9245 9308 6f9012ba 9243->9308 9245->9239 9312 6f9026b8 9245->9312 9248 6f902abe 9246->9248 9247 6f902b63 CreateToolhelp32Snapshot 9251 6f902b81 9247->9251 9248->9247 9250 6f902c4d 9250->9171 9315 6f902a56 9251->9315 9253 6f902367 9252->9253 9254 6f902372 GlobalAlloc 9253->9254 9255 6f9017c8 9253->9255 9254->9253 9255->9152 9260 6f902754 9256->9260 9257 6f902802 9259 6f902808 GlobalSize 9257->9259 9261 6f902812 9257->9261 9258 6f9027ef GlobalAlloc 9258->9261 9259->9261 9260->9257 9260->9258 9261->9176 9263 6f902d42 9262->9263 9264 6f902d82 GlobalFree 9263->9264 9319 6f90121b GlobalAlloc 9265->9319 9267 6f9025ec MultiByteToWideChar 9270 6f902573 9267->9270 9268 6f90260e StringFromGUID2 9268->9270 9269 6f90261f lstrcpynW 9269->9270 9270->9267 9270->9268 9270->9269 9271 6f902632 wsprintfW 9270->9271 9272 6f902656 GlobalFree 9270->9272 9273 6f90268b GlobalFree 9270->9273 9274 6f901272 2 API calls 9270->9274 9320 6f9012e1 9270->9320 9271->9270 9272->9270 9273->9169 9274->9270 9324 6f90121b GlobalAlloc 9276->9324 9278 6f9015b9 9279 6f9015c6 2 API calls 9278->9279 9280 6f9015c3 9279->9280 9281 6f901272 9280->9281 9282 6f9012b5 GlobalFree 9281->9282 9283 6f90127b GlobalAlloc lstrcpynW 9281->9283 9282->9174 9283->9282 9285 6f9015d2 wsprintfW 9284->9285 9286 6f9015ff lstrcpyW 9284->9286 9289 6f901618 9285->9289 9286->9289 9289->9177 9291 6f90253a 9290->9291 9293 6f901891 9290->9293 9292 6f902556 GlobalFree 9291->9292 9291->9293 9292->9291 9293->9185 9293->9186 9295 6f901272 2 API calls 9294->9295 9296 6f90155e 9295->9296 9296->9180 9297->9204 9298->9231 9300 6f9015ad 9299->9300 9300->9227 9307 6f90121b GlobalAlloc 9301->9307 9303 6f90123b lstrcpynW 9303->9222 9304->9235 9305->9223 9306->9230 9307->9303 9309 6f9012c1 9308->9309 9310 6f90122c 2 API calls 9309->9310 9311 6f9012df 9310->9311 9311->9243 9313 6f9026c6 VirtualAlloc 9312->9313 9314 6f90271c 9312->9314 9313->9314 9314->9245 9316 6f902a61 9315->9316 9317 6f902a71 9316->9317 9318 6f902a66 GetLastError 9316->9318 9317->9250 9318->9317 9319->9270 9321 6f9012ea 9320->9321 9322 6f90130c 9320->9322 9321->9322 9323 6f9012f0 lstrcpyW 9321->9323 9322->9270 9323->9322 9324->9278 9326 6f6f7b37 9325->9326 9328 6f6f7b54 9325->9328 9327 6f6f7b45 GetFullPathNameW 9326->9327 9326->9328 9327->9328 9328->9201 10813 402a35 10814 402c1f 17 API calls 10813->10814 10815 402a3b 10814->10815 10816 40288b 10815->10816 10817 402a72 10815->10817 10819 402a4d 10815->10819 10817->10816 10818 4062dc 17 API calls 10817->10818 10818->10816 10819->10816 10821 406201 wsprintfW 10819->10821 10821->10816 10822 401735 10823 402c41 17 API calls 10822->10823 10824 40173c SearchPathW 10823->10824 10825 401757 10824->10825 10827 4029e6 10824->10827 10825->10827 10828 4062ba lstrcpynW 10825->10828 10828->10827 9368 10001377 9375 1000143a 9368->9375 9376 100013a3 9375->9376 9378 10001443 9375->9378 9380 100010d0 GetVersionExW 9376->9380 9377 10001473 GlobalFree 9377->9376 9378->9376 9378->9377 9379 1000145f lstrcpynW 9378->9379 9379->9377 9381 10001100 9380->9381 9382 1000110a 9380->9382 9406 100014cf wsprintfW 9381->9406 9383 10001115 9382->9383 9384 1000112c LoadLibraryW 9382->9384 9383->9381 9385 10001227 LoadLibraryA 9383->9385 9386 10001145 GetProcAddress 9384->9386 9396 100011af 9384->9396 9385->9381 9388 1000123f GetProcAddress GetProcAddress GetProcAddress 9385->9388 9387 10001158 LocalAlloc 9386->9387 9393 10001198 9386->9393 9389 10001193 9387->9389 9391 1000133a FreeLibrary 9388->9391 9404 1000126e 9388->9404 9392 10001166 NtQuerySystemInformation 9389->9392 9389->9393 9390 100011a4 FreeLibrary 9390->9396 9391->9381 9392->9390 9395 10001179 LocalFree 9392->9395 9393->9390 9394 100011c9 lstrcpynW lstrcmpiW 9394->9396 9395->9393 9398 1000118a LocalAlloc 9395->9398 9396->9381 9396->9394 9397 10001219 LocalFree 9396->9397 9399 100011f9 9396->9399 9397->9381 9398->9389 9399->9396 9409 1000103f OpenProcess 9399->9409 9401 10001333 CloseHandle 9401->9391 9402 100012a8 lstrlenW 9402->9404 9403 100012c9 lstrlenA MultiByteToWideChar lstrcmpiW 9403->9404 9404->9391 9404->9401 9404->9402 9404->9403 9405 1000103f 8 API calls 9404->9405 9405->9404 9422 10001489 9406->9422 9410 10001060 9409->9410 9411 100010cb 9409->9411 9412 1000106b EnumWindows 9410->9412 9413 100010ac TerminateProcess 9410->9413 9411->9399 9412->9413 9414 1000107f GetExitCodeProcess 9412->9414 9419 10001007 GetWindowThreadProcessId 9412->9419 9415 100010a7 9413->9415 9416 100010be CloseHandle 9413->9416 9414->9415 9417 1000108e 9414->9417 9415->9416 9416->9411 9417->9415 9418 10001097 WaitForSingleObject 9417->9418 9418->9413 9418->9415 9420 10001024 PostMessageW 9419->9420 9421 10001036 9419->9421 9420->9421 9423 10001492 GlobalAlloc lstrcpynW 9422->9423 9424 100013b6 9422->9424 9423->9424 8544 4015c1 8545 402c41 17 API calls 8544->8545 8546 4015c8 8545->8546 8547 405c3a 4 API calls 8546->8547 8557 4015d1 8547->8557 8548 401631 8550 401663 8548->8550 8551 401636 8548->8551 8549 405bbc CharNextW 8549->8557 8554 401423 24 API calls 8550->8554 8571 401423 8551->8571 8560 40165b 8554->8560 8557->8548 8557->8549 8561 401617 GetFileAttributesW 8557->8561 8563 40588b 8557->8563 8566 4057f1 CreateDirectoryW 8557->8566 8575 40586e CreateDirectoryW 8557->8575 8559 40164a SetCurrentDirectoryW 8559->8560 8561->8557 8578 406694 GetModuleHandleA 8563->8578 8567 405842 GetLastError 8566->8567 8568 40583e 8566->8568 8567->8568 8569 405851 SetFileSecurityW 8567->8569 8568->8557 8569->8568 8570 405867 GetLastError 8569->8570 8570->8568 8572 405322 24 API calls 8571->8572 8573 401431 8572->8573 8574 4062ba lstrcpynW 8573->8574 8574->8559 8576 405882 GetLastError 8575->8576 8577 40587e 8575->8577 8576->8577 8577->8557 8579 4066b0 8578->8579 8580 4066ba GetProcAddress 8578->8580 8584 406624 GetSystemDirectoryW 8579->8584 8582 405892 8580->8582 8582->8557 8583 4066b6 8583->8580 8583->8582 8585 406646 wsprintfW LoadLibraryExW 8584->8585 8585->8583 10920 4016cc 10921 402c41 17 API calls 10920->10921 10922 4016d2 GetFullPathNameW 10921->10922 10923 40170e 10922->10923 10924 4016ec 10922->10924 10925 401723 GetShortPathNameW 10923->10925 10926 402ac5 10923->10926 10924->10923 10927 4065fd 2 API calls 10924->10927 10925->10926 10928 4016fe 10927->10928 10928->10923 10930 4062ba lstrcpynW 10928->10930 10930->10923 9329 6f7013e6 9330 6f70140b ??2@YAPAXI memset _wsetlocale 9329->9330 9332 6f703681 2 API calls 9330->9332 9333 6f70147e 9332->9333 9334 6f7035f4 2 API calls 9333->9334 9335 6f701483 9334->9335 9336 6f703616 2 API calls 9335->9336 9337 6f701489 9336->9337 9338 6f6f7a42 16 API calls 9337->9338 9339 6f701491 9338->9339 9341 6f7036d0 2 API calls 9339->9341 9344 6f7014a8 9341->9344 9342 6f7014dd 9343 6f7014c9 memset ??3@YAXPAX 9343->9342 9344->9342 9344->9343 9344->9344 8621 6f7e1cd0 8622 6f7e1ce2 8621->8622 8630 6f7e1fc7 8621->8630 8644 6f7e1710 GlobalAlloc GlobalAlloc 8622->8644 8624 6f7e1d1a 6 API calls 8625 6f7e1d83 FindWindowExW GetDlgItem 8624->8625 8626 6f7e1da0 8624->8626 8625->8626 8627 6f7e1db9 CreateThread 8626->8627 8628 6f7e1e55 8626->8628 8629 6f7e1ddc 8627->8629 8627->8630 8680 6f7e1af0 CreateDialogParamW 8627->8680 8631 6f7e1e5d CreateThread 8628->8631 8632 6f7e1e96 8628->8632 8638 6f7e1de8 Sleep 8629->8638 8639 6f7e1df2 6 API calls 8629->8639 8631->8630 8635 6f7e1e81 8631->8635 8688 6f7e1bd0 8631->8688 8633 6f7e1f0e 8632->8633 8634 6f7e1ea4 SetWindowLongW GetWindowPlacement GetClientRect ShowWindow SetWindowPos 8632->8634 8655 6f7e15c0 GetClientRect 8633->8655 8636 6f7e1f99 SetWindowLongW SetWindowPos 8634->8636 8640 6f7e1e89 Sleep 8635->8640 8641 6f7e1e93 CloseHandle 8635->8641 8636->8630 8638->8629 8639->8628 8640->8635 8641->8632 8642 6f7e1f21 8642->8636 8643 6f7e1f2c 6 API calls 8642->8643 8643->8636 8646 6f7e1740 8644->8646 8645 6f7e2197 lstrcpyW GlobalFree 8645->8646 8646->8645 8647 6f7e178e 8646->8647 8651 6f7e17d7 8646->8651 8653 6f7e17af DestroyIcon 8646->8653 8654 6f7e17c0 LoadImageW 8646->8654 8664 6f7e13d0 lstrcmpiW 8646->8664 8649 6f7e17e6 GetModuleHandleW LoadImageW 8647->8649 8650 6f7e1800 GlobalFree GlobalFree 8647->8650 8649->8650 8650->8624 8677 6f7e21d7 8651->8677 8653->8654 8654->8646 8656 6f7e168b GetSystemMetrics GetSystemMetrics GetSystemMetrics GetSystemMetrics 8655->8656 8657 6f7e15e7 8655->8657 8658 6f7e16d1 GetSystemMetrics 8656->8658 8659 6f7e15ee 8657->8659 8660 6f7e15fd GetSystemMetrics GetSystemMetrics 8657->8660 8661 6f7e1624 GetSystemMetrics GetSystemMetrics GetSystemMetrics 8657->8661 8662 6f7e1651 GetSystemMetrics GetSystemMetrics GetSystemMetrics GetSystemMetrics 8657->8662 8658->8659 8663 6f7e16db SetWindowPos 8659->8663 8660->8663 8661->8659 8662->8658 8663->8642 8665 6f7e13e8 8664->8665 8666 6f7e13f0 lstrcmpiW 8664->8666 8665->8646 8667 6f7e13fc 8666->8667 8668 6f7e1404 lstrcmpiW 8666->8668 8667->8646 8669 6f7e1418 lstrcmpiW 8668->8669 8670 6f7e1410 8668->8670 8671 6f7e142c lstrcmpiW 8669->8671 8672 6f7e1424 8669->8672 8670->8646 8673 6f7e1438 8671->8673 8674 6f7e1440 lstrcmpiW 8671->8674 8672->8646 8673->8646 8675 6f7e144c 8674->8675 8676 6f7e1454 lstrcmpiW 8674->8676 8675->8646 8676->8646 8678 6f7e221a 8677->8678 8679 6f7e21e0 GlobalAlloc lstrcpynW 8677->8679 8678->8647 8679->8678 8681 6f7e1b1c GetDlgItem SendMessageW SendMessageW IsWindow 8680->8681 8682 6f7e1bb3 8680->8682 8681->8682 8683 6f7e1b71 8681->8683 8684 6f7e1b85 PeekMessageW 8683->8684 8685 6f7e1b9c DispatchMessageW 8684->8685 8686 6f7e1ba5 WaitMessage 8684->8686 8687 6f7e1ba7 IsWindow 8685->8687 8686->8687 8687->8682 8687->8684 8689 6f7e1bdc FindWindowExW 8688->8689 8690 6f7e1bf3 8688->8690 8689->8690 8700 6f7e1350 CreateWindowExW 8690->8700 8692 6f7e1c05 8693 6f7e1c15 SendMessageW SendMessageW SendMessageW IsWindow 8692->8693 8699 6f7e1cb0 8692->8699 8694 6f7e1c6a 8693->8694 8693->8699 8695 6f7e1c80 PeekMessageW 8694->8695 8696 6f7e1c98 DispatchMessageW 8695->8696 8697 6f7e1ca1 WaitMessage 8695->8697 8698 6f7e1ca3 IsWindow 8696->8698 8697->8698 8698->8695 8698->8699 8701 6f7e1383 GlobalAlloc GlobalAlloc SetWindowLongW SetWindowPos 8700->8701 8702 6f7e1381 8700->8702 8701->8692 8702->8692 9527 6f7e18c0 9528 6f7e18ef CallWindowProcW 9527->9528 9529 6f7e18d2 SendMessageW 9527->9529 9529->9528 8590 402484 8601 402c81 8590->8601 8593 402c41 17 API calls 8594 402497 8593->8594 8595 4024a2 RegQueryValueExW 8594->8595 8597 40288b 8594->8597 8596 4024c2 8595->8596 8600 4024c8 RegCloseKey 8595->8600 8596->8600 8606 406201 wsprintfW 8596->8606 8600->8597 8602 402c41 17 API calls 8601->8602 8603 402c98 8602->8603 8604 406127 RegOpenKeyExW 8603->8604 8605 40248e 8604->8605 8605->8593 8606->8600 8703 6f7e19b0 8704 6f7e1a88 8703->8704 8705 6f7e19c3 GetActiveWindow 8703->8705 8708 6f7e1a8d GetActiveWindow 8704->8708 8709 6f7e1ae6 8704->8709 8706 6f7e19d9 ShowWindow 8705->8706 8707 6f7e19e4 9 API calls 8705->8707 8706->8707 8717 6f7e1470 16 API calls 8707->8717 8711 6f7e1aae ShowWindow SetWindowPos DestroyWindow 8708->8711 8712 6f7e1aa3 ShowWindow 8708->8712 8718 6f7e1470 16 API calls 8711->8718 8712->8711 8714 6f7e1a7a 8715 6f7e1ade 8719 6f7e1530 9 API calls 8715->8719 8717->8714 8718->8715 8719->8709 8789 40338f SetErrorMode GetVersion 8790 4033ce 8789->8790 8791 4033d4 8789->8791 8792 406694 5 API calls 8790->8792 8793 406624 3 API calls 8791->8793 8792->8791 8794 4033ea lstrlenA 8793->8794 8794->8791 8795 4033fa 8794->8795 8796 406694 5 API calls 8795->8796 8797 403401 8796->8797 8798 406694 5 API calls 8797->8798 8799 403408 8798->8799 8800 406694 5 API calls 8799->8800 8801 403414 #17 OleInitialize SHGetFileInfoW 8800->8801 8879 4062ba lstrcpynW 8801->8879 8804 403460 GetCommandLineW 8880 4062ba lstrcpynW 8804->8880 8806 403472 8807 405bbc CharNextW 8806->8807 8808 403497 CharNextW 8807->8808 8809 4035c1 GetTempPathW 8808->8809 8819 4034b0 8808->8819 8881 40335e 8809->8881 8811 4035d9 8812 403633 DeleteFileW 8811->8812 8813 4035dd GetWindowsDirectoryW lstrcatW 8811->8813 8891 402edd GetTickCount GetModuleFileNameW 8812->8891 8816 40335e 12 API calls 8813->8816 8814 405bbc CharNextW 8814->8819 8818 4035f9 8816->8818 8817 403647 8824 4036ea 8817->8824 8828 405bbc CharNextW 8817->8828 8874 4036fa 8817->8874 8818->8812 8820 4035fd GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 8818->8820 8819->8814 8821 4035ac 8819->8821 8823 4035aa 8819->8823 8822 40335e 12 API calls 8820->8822 8975 4062ba lstrcpynW 8821->8975 8826 40362b 8822->8826 8823->8809 8919 4039aa 8824->8919 8826->8812 8826->8874 8845 403666 8828->8845 8831 403834 8833 4038b8 ExitProcess 8831->8833 8834 40383c GetCurrentProcess OpenProcessToken 8831->8834 8832 403714 8835 405920 MessageBoxIndirectW 8832->8835 8836 403854 LookupPrivilegeValueW AdjustTokenPrivileges 8834->8836 8837 403888 8834->8837 8841 403722 ExitProcess 8835->8841 8836->8837 8844 406694 5 API calls 8837->8844 8839 4036c4 8842 405c97 18 API calls 8839->8842 8840 40372a 8843 40588b 5 API calls 8840->8843 8846 4036d0 8842->8846 8847 40372f lstrcatW 8843->8847 8848 40388f 8844->8848 8845->8839 8845->8840 8846->8874 8976 4062ba lstrcpynW 8846->8976 8849 403740 lstrcatW 8847->8849 8850 40374b lstrcatW lstrcmpiW 8847->8850 8851 4038a4 ExitWindowsEx 8848->8851 8854 4038b1 8848->8854 8849->8850 8853 403767 8850->8853 8850->8874 8851->8833 8851->8854 8856 403773 8853->8856 8857 40376c 8853->8857 8990 40140b 8854->8990 8855 4036df 8977 4062ba lstrcpynW 8855->8977 8861 40586e 2 API calls 8856->8861 8860 4057f1 4 API calls 8857->8860 8862 403771 8860->8862 8863 403778 SetCurrentDirectoryW 8861->8863 8862->8863 8864 403793 8863->8864 8865 403788 8863->8865 8986 4062ba lstrcpynW 8864->8986 8985 4062ba lstrcpynW 8865->8985 8868 4062dc 17 API calls 8869 4037d2 DeleteFileW 8868->8869 8870 4037df CopyFileW 8869->8870 8876 4037a1 8869->8876 8870->8876 8871 403828 8873 406080 36 API calls 8871->8873 8872 406080 36 API calls 8872->8876 8873->8874 8978 4038d0 8874->8978 8875 4062dc 17 API calls 8875->8876 8876->8868 8876->8871 8876->8872 8876->8875 8878 403813 CloseHandle 8876->8878 8987 4058a3 CreateProcessW 8876->8987 8878->8876 8879->8804 8880->8806 8882 40654e 5 API calls 8881->8882 8884 40336a 8882->8884 8883 403374 8883->8811 8884->8883 8885 405b8f 3 API calls 8884->8885 8886 40337c 8885->8886 8887 40586e 2 API calls 8886->8887 8888 403382 8887->8888 8993 405ddf 8888->8993 8997 405db0 GetFileAttributesW CreateFileW 8891->8997 8893 402f1d 8913 402f2d 8893->8913 8998 4062ba lstrcpynW 8893->8998 8895 402f43 8896 405bdb 2 API calls 8895->8896 8897 402f49 8896->8897 8999 4062ba lstrcpynW 8897->8999 8899 402f54 GetFileSize 8900 403050 8899->8900 8918 402f6b 8899->8918 9000 402e79 8900->9000 8902 403059 8904 403089 GlobalAlloc 8902->8904 8902->8913 9012 403347 SetFilePointer 8902->9012 8903 403331 ReadFile 8903->8918 9011 403347 SetFilePointer 8904->9011 8906 4030bc 8910 402e79 6 API calls 8906->8910 8908 403072 8911 403331 ReadFile 8908->8911 8909 4030a4 8912 403116 31 API calls 8909->8912 8910->8913 8914 40307d 8911->8914 8916 4030b0 8912->8916 8913->8817 8914->8904 8914->8913 8915 402e79 6 API calls 8915->8918 8916->8913 8916->8916 8917 4030ed SetFilePointer 8916->8917 8917->8913 8918->8900 8918->8903 8918->8906 8918->8913 8918->8915 8920 406694 5 API calls 8919->8920 8921 4039be 8920->8921 8922 4039c4 8921->8922 8923 4039d6 8921->8923 9025 406201 wsprintfW 8922->9025 8924 406188 3 API calls 8923->8924 8925 403a06 8924->8925 8927 403a25 lstrcatW 8925->8927 8929 406188 3 API calls 8925->8929 8928 4039d4 8927->8928 9017 403c80 8928->9017 8929->8927 8932 405c97 18 API calls 8934 403a57 8932->8934 8933 403aeb 8935 405c97 18 API calls 8933->8935 8934->8933 8936 406188 3 API calls 8934->8936 8937 403af1 8935->8937 8938 403a89 8936->8938 8939 403b01 LoadImageW 8937->8939 8940 4062dc 17 API calls 8937->8940 8938->8933 8943 403aaa lstrlenW 8938->8943 8946 405bbc CharNextW 8938->8946 8941 403ba7 8939->8941 8942 403b28 RegisterClassW 8939->8942 8940->8939 8945 40140b 2 API calls 8941->8945 8944 403b5e SystemParametersInfoW CreateWindowExW 8942->8944 8974 403bb1 8942->8974 8947 403ab8 lstrcmpiW 8943->8947 8948 403ade 8943->8948 8944->8941 8949 403bad 8945->8949 8951 403aa7 8946->8951 8947->8948 8952 403ac8 GetFileAttributesW 8947->8952 8950 405b8f 3 API calls 8948->8950 8953 403c80 18 API calls 8949->8953 8949->8974 8954 403ae4 8950->8954 8951->8943 8955 403ad4 8952->8955 8956 403bbe 8953->8956 9026 4062ba lstrcpynW 8954->9026 8955->8948 8958 405bdb 2 API calls 8955->8958 8959 403bca ShowWindow 8956->8959 8960 403c4d 8956->8960 8958->8948 8962 406624 3 API calls 8959->8962 8961 4053f5 5 API calls 8960->8961 8963 403c53 8961->8963 8964 403be2 8962->8964 8965 403c57 8963->8965 8966 403c6f 8963->8966 8967 403bf0 GetClassInfoW 8964->8967 8969 406624 3 API calls 8964->8969 8972 40140b 2 API calls 8965->8972 8965->8974 8968 40140b 2 API calls 8966->8968 8970 403c04 GetClassInfoW RegisterClassW 8967->8970 8971 403c1a DialogBoxParamW 8967->8971 8968->8974 8969->8967 8970->8971 8973 40140b 2 API calls 8971->8973 8972->8974 8973->8974 8974->8874 8975->8823 8976->8855 8977->8824 8979 4038e8 8978->8979 8980 4038da CloseHandle 8978->8980 9031 403915 8979->9031 8980->8979 8983 4059cc 67 API calls 8984 403703 OleUninitialize 8983->8984 8984->8831 8984->8832 8985->8864 8986->8876 8988 4058e2 8987->8988 8989 4058d6 CloseHandle 8987->8989 8988->8876 8989->8988 8991 401389 2 API calls 8990->8991 8992 401420 8991->8992 8992->8833 8994 405dec GetTickCount GetTempFileNameW 8993->8994 8995 405e22 8994->8995 8996 40338d 8994->8996 8995->8994 8995->8996 8996->8811 8997->8893 8998->8895 8999->8899 9001 402e82 9000->9001 9002 402e9a 9000->9002 9003 402e92 9001->9003 9004 402e8b DestroyWindow 9001->9004 9005 402ea2 9002->9005 9006 402eaa GetTickCount 9002->9006 9003->8902 9004->9003 9013 4066d0 9005->9013 9007 402eb8 CreateDialogParamW ShowWindow 9006->9007 9008 402edb 9006->9008 9007->9008 9008->8902 9011->8909 9012->8908 9014 4066ed PeekMessageW 9013->9014 9015 4066e3 DispatchMessageW 9014->9015 9016 402ea8 9014->9016 9015->9014 9016->8902 9018 403c94 9017->9018 9027 406201 wsprintfW 9018->9027 9020 403d05 9028 403d39 9020->9028 9022 403a35 9022->8932 9023 403d0a 9023->9022 9024 4062dc 17 API calls 9023->9024 9024->9023 9025->8928 9026->8933 9027->9020 9029 4062dc 17 API calls 9028->9029 9030 403d47 SetWindowTextW 9029->9030 9030->9023 9032 403923 9031->9032 9033 403928 FreeLibrary GlobalFree 9032->9033 9034 4038ed 9032->9034 9033->9033 9033->9034 9034->8983 11418 405296 11419 4052a6 11418->11419 11420 4052ba 11418->11420 11421 405303 11419->11421 11422 4052ac 11419->11422 11423 4052c2 IsWindowVisible 11420->11423 11429 4052d9 11420->11429 11424 405308 CallWindowProcW 11421->11424 11425 40427d SendMessageW 11422->11425 11423->11421 11426 4052cf 11423->11426 11427 4052b6 11424->11427 11425->11427 11431 404bec SendMessageW 11426->11431 11429->11424 11436 404c6c 11429->11436 11432 404c4b SendMessageW 11431->11432 11433 404c0f GetMessagePos ScreenToClient SendMessageW 11431->11433 11434 404c43 11432->11434 11433->11434 11435 404c48 11433->11435 11434->11429 11435->11432 11445 4062ba lstrcpynW 11436->11445 11438 404c7f 11446 406201 wsprintfW 11438->11446 11440 404c89 11441 40140b 2 API calls 11440->11441 11442 404c92 11441->11442 11447 4062ba lstrcpynW 11442->11447 11444 404c99 11444->11421 11445->11438 11446->11440 11447->11444 11646 4029a8 11647 402c1f 17 API calls 11646->11647 11648 4029ae 11647->11648 11649 4029d5 11648->11649 11650 4029ee 11648->11650 11654 40288b 11648->11654 11651 4029da 11649->11651 11658 4029eb 11649->11658 11652 402a08 11650->11652 11653 4029f8 11650->11653 11660 4062ba lstrcpynW 11651->11660 11656 4062dc 17 API calls 11652->11656 11655 402c1f 17 API calls 11653->11655 11655->11654 11656->11654 11661 406201 wsprintfW 11658->11661 11660->11654 11661->11654 9035 6f701280 9037 6f7012a2 ??2@YAPAXI memset ??2@YAPAXI memset _wsetlocale 9035->9037 9058 6f703681 9037->9058 9040 6f703681 2 API calls 9041 6f701348 9040->9041 9063 6f7035f4 9041->9063 9048 6f7035f4 2 API calls 9049 6f701369 9048->9049 9050 6f703616 2 API calls 9049->9050 9051 6f70136f 9050->9051 9080 6f7036d0 9051->9080 9053 6f70139f memset ??3@YAXPAX 9057 6f7013b0 9053->9057 9054 6f7013e3 9055 6f701378 9055->9053 9055->9055 9055->9057 9056 6f7013d2 memset ??3@YAXPAX 9056->9054 9057->9054 9057->9056 9057->9057 9059 6f701341 9058->9059 9061 6f70368a 9058->9061 9059->9040 9060 6f7036ba GlobalFree 9060->9059 9061->9059 9061->9060 9062 6f7036a6 lstrcpynW 9061->9062 9062->9060 9064 6f70134f 9063->9064 9066 6f703600 9063->9066 9067 6f703616 9064->9067 9066->9064 9083 6f7035d0 9066->9083 9068 6f701355 9067->9068 9070 6f703621 9067->9070 9071 6f6f7a42 9068->9071 9069 6f7035d0 2 API calls 9069->9070 9070->9068 9070->9069 9072 6f6f7a4d 9071->9072 9079 6f6f7aa6 9071->9079 9072->9079 9087 6f6f7901 9072->9087 9076 6f7035f4 2 API calls 9077 6f6f7a6c 9076->9077 9077->9076 9077->9079 9102 6f6f794c 9077->9102 9079->9048 9081 6f703713 9080->9081 9082 6f7036d9 GlobalAlloc lstrcpynW 9080->9082 9081->9055 9082->9081 9084 6f7035ed 9083->9084 9085 6f7035d5 iswcntrl 9083->9085 9084->9066 9085->9084 9086 6f7035e1 iswspace 9085->9086 9086->9084 9088 6f6f7942 9087->9088 9089 6f6f7910 9087->9089 9088->9077 9088->9079 9091 6f6f785a EnterCriticalSection 9088->9091 9089->9088 9090 6f6f7923 iswgraph 9089->9090 9090->9088 9090->9089 9092 6f6f78db 9091->9092 9093 6f6f787a __wgetmainargs 9091->9093 9094 6f6f78ea 9092->9094 9095 6f6f78e3 LeaveCriticalSection 9092->9095 9096 6f6f78c1 9093->9096 9097 6f6f78a0 GetVersion 9093->9097 9094->9077 9095->9094 9098 6f6f78ef 9096->9098 9099 6f6f78ca 9096->9099 9097->9096 9097->9098 9098->9094 9100 6f6f78f6 LeaveCriticalSection 9098->9100 9114 6f6f591f EnterCriticalSection 9099->9114 9100->9094 9103 6f6f795c 9102->9103 9104 6f6f7981 iswgraph 9103->9104 9109 6f6f7a0f 9103->9109 9105 6f6f7994 9104->9105 9104->9109 9106 6f6f799e wcschr 9105->9106 9105->9109 9107 6f6f79af 9106->9107 9108 6f6f7a16 _wcsicmp 9106->9108 9107->9108 9110 6f6f79b4 9107->9110 9108->9109 9109->9077 9110->9109 9111 6f6f79d3 _wcsnicmp 9110->9111 9111->9109 9112 6f6f79e5 9111->9112 9112->9109 9113 6f6f79f5 wcsncpy 9112->9113 9113->9109 9115 6f6f593f 9114->9115 9116 6f6f5951 abort 9114->9116 9117 6f6f595e LeaveCriticalSection 9115->9117 9118 6f6f5965 9115->9118 9116->9115 9117->9118 9118->9092

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 0040338F Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 410stringfilecomCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 0 40338f-4033cc SetErrorMode GetVersion 1 4033ce-4033d6 call 406694 0->1 2 4033df 0->2 1->2 7 4033d8 1->7 4 4033e4-4033f8 call 406624 lstrlenA 2->4 9 4033fa-403416 call 406694 * 3 4->9 7->2 16 403427-403486 #17 OleInitialize SHGetFileInfoW call 4062ba GetCommandLineW call 4062ba 9->16 17 403418-40341e 9->17 24 403490-4034aa call 405bbc CharNextW 16->24 25 403488-40348f 16->25 17->16 21 403420 17->21 21->16 28 4034b0-4034b6 24->28 29 4035c1-4035db GetTempPathW call 40335e 24->29 25->24 30 4034b8-4034bd 28->30 31 4034bf-4034c3 28->31 38 403633-40364d DeleteFileW call 402edd 29->38 39 4035dd-4035fb GetWindowsDirectoryW lstrcatW call 40335e 29->39 30->30 30->31 33 4034c5-4034c9 31->33 34 4034ca-4034ce 31->34 33->34 36 4034d4-4034da 34->36 37 40358d-40359a call 405bbc 34->37 42 4034f5-40352e 36->42 43 4034dc-4034e4 36->43 52 40359c-40359d 37->52 53 40359e-4035a4 37->53 54 403653-403659 38->54 55 4036fe-40370e call 4038d0 OleUninitialize 38->55 39->38 58 4035fd-40362d GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 40335e 39->58 49 403530-403535 42->49 50 40354b-403585 42->50 47 4034e6-4034e9 43->47 48 4034eb 43->48 47->42 47->48 48->42 49->50 56 403537-40353f 49->56 50->37 57 403587-40358b 50->57 52->53 53->28 61 4035aa 53->61 62 4036ee-4036f5 call 4039aa 54->62 63 40365f-40366a call 405bbc 54->63 75 403834-40383a 55->75 76 403714-403724 call 405920 ExitProcess 55->76 65 403541-403544 56->65 66 403546 56->66 57->37 59 4035ac-4035ba call 4062ba 57->59 58->38 58->55 68 4035bf 59->68 61->68 74 4036fa 62->74 79 4036b8-4036c2 63->79 80 40366c-4036a1 63->80 65->50 65->66 66->50 68->29 74->55 77 4038b8-4038c0 75->77 78 40383c-403852 GetCurrentProcess OpenProcessToken 75->78 85 4038c2 77->85 86 4038c6-4038ca ExitProcess 77->86 82 403854-403882 LookupPrivilegeValueW AdjustTokenPrivileges 78->82 83 403888-403896 call 406694 78->83 87 4036c4-4036d2 call 405c97 79->87 88 40372a-40373e call 40588b lstrcatW 79->88 84 4036a3-4036a7 80->84 82->83 102 4038a4-4038af ExitWindowsEx 83->102 103 403898-4038a2 83->103 93 4036b0-4036b4 84->93 94 4036a9-4036ae 84->94 85->86 87->55 99 4036d4-4036ea call 4062ba * 2 87->99 100 403740-403746 lstrcatW 88->100 101 40374b-403765 lstrcatW lstrcmpiW 88->101 93->84 98 4036b6 93->98 94->93 94->98 98->79 99->62 100->101 101->55 105 403767-40376a 101->105 102->77 106 4038b1-4038b3 call 40140b 102->106 103->102 103->106 108 403773 call 40586e 105->108 109 40376c-403771 call 4057f1 105->109 106->77 117 403778-403786 SetCurrentDirectoryW 108->117 109->117 118 403793-4037bc call 4062ba 117->118 119 403788-40378e call 4062ba 117->119 123 4037c1-4037dd call 4062dc DeleteFileW 118->123 119->118 126 40381e-403826 123->126 127 4037df-4037ef CopyFileW 123->127 126->123 129 403828-40382f call 406080 126->129 127->126 128 4037f1-403811 call 406080 call 4062dc call 4058a3 127->128 128->126 138 403813-40381a CloseHandle 128->138 129->55 138->126
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetErrorMode.KERNEL32 ref: 004033B2
                                                                                                                                                                                        • GetVersion.KERNEL32 ref: 004033B8
                                                                                                                                                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
                                                                                                                                                                                        • #17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 0040342F
                                                                                                                                                                                        • SHGetFileInfoW.SHELL32(00440208,00000000,?,000002B4,00000000), ref: 0040344B
                                                                                                                                                                                        • GetCommandLineW.KERNEL32(00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
                                                                                                                                                                                        • CharNextW.USER32(00000000,004CB000,00000020,004CB000,00000000,?,00000006,00000008,0000000A), ref: 00403498
                                                                                                                                                                                          • Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                          • Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                        • GetTempPathW.KERNEL32(00002000,004DF000,?,00000006,00000008,0000000A), ref: 004035D2
                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(004DF000,00001FFB,?,00000006,00000008,0000000A), ref: 004035E3
                                                                                                                                                                                        • lstrcatW.KERNEL32(004DF000,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
                                                                                                                                                                                        • GetTempPathW.KERNEL32(00001FFC,004DF000,004DF000,\Temp,?,00000006,00000008,0000000A), ref: 00403603
                                                                                                                                                                                        • lstrcatW.KERNEL32(004DF000,Low,?,00000006,00000008,0000000A), ref: 0040360B
                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TEMP,004DF000,004DF000,Low,?,00000006,00000008,0000000A), ref: 0040361C
                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TMP,004DF000,?,00000006,00000008,0000000A), ref: 00403624
                                                                                                                                                                                        • DeleteFileW.KERNEL32(004DB000,?,00000006,00000008,0000000A), ref: 00403638
                                                                                                                                                                                          • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                        • OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403703
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403724
                                                                                                                                                                                        • lstrcatW.KERNEL32(004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
                                                                                                                                                                                        • lstrcatW.KERNEL32(004DF000,0040A26C,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
                                                                                                                                                                                        • lstrcatW.KERNEL32(004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
                                                                                                                                                                                        • lstrcmpiW.KERNEL32(004DF000,004D7000,004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(004DF000,004DF000,?,00000006,00000008,0000000A), ref: 00403779
                                                                                                                                                                                        • DeleteFileW.KERNEL32(0043C208,0043C208,?,0047B000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
                                                                                                                                                                                        • CopyFileW.KERNEL32(004E7000,0043C208,00000001,?,00000006,00000008,0000000A), ref: 004037E7
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,0043C208,0043C208,?,0043C208,00000000,?,00000006,00000008,0000000A), ref: 00403814
                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
                                                                                                                                                                                        • AdjustTokenPrivileges.ADVAPI32 ref: 00403882
                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004038CA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
                                                                                                                                                                                        • String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                        • API String ID: 3441113951-3195845224
                                                                                                                                                                                        • Opcode ID: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
                                                                                                                                                                                        • Instruction ID: 33fbdd78d52bfd04f2c73b4da217482bb076a8c6d1615cdfa2cd3638f3c4bec2
                                                                                                                                                                                        • Opcode Fuzzy Hash: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
                                                                                                                                                                                        • Instruction Fuzzy Hash: 45D1F471100310AAE720BF769D45B2B3AADEB4070AF10447FF885B62E1DBBD8D55876E
                                                                                                                                                                                        Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 139 405461-40547c 140 405482-405549 GetDlgItem * 3 call 404266 call 404bbf GetClientRect GetSystemMetrics SendMessageW * 2 139->140 141 40560b-405612 139->141 163 405567-40556a 140->163 164 40554b-405565 SendMessageW * 2 140->164 143 405614-405636 GetDlgItem CreateThread CloseHandle 141->143 144 40563c-405649 141->144 143->144 146 405667-405671 144->146 147 40564b-405651 144->147 148 405673-405679 146->148 149 4056c7-4056cb 146->149 151 405653-405662 ShowWindow * 2 call 404266 147->151 152 40568c-405695 call 404298 147->152 153 4056a1-4056b1 ShowWindow 148->153 154 40567b-405687 call 40420a 148->154 149->152 157 4056cd-4056d3 149->157 151->146 160 40569a-40569e 152->160 161 4056c1-4056c2 call 40420a 153->161 162 4056b3-4056bc call 405322 153->162 154->152 157->152 165 4056d5-4056e8 SendMessageW 157->165 161->149 162->161 168 40557a-405591 call 404231 163->168 169 40556c-405578 SendMessageW 163->169 164->163 170 4057ea-4057ec 165->170 171 4056ee-405719 CreatePopupMenu call 4062dc AppendMenuW 165->171 178 405593-4055a7 ShowWindow 168->178 179 4055c7-4055e8 GetDlgItem SendMessageW 168->179 169->168 170->160 176 40571b-40572b GetWindowRect 171->176 177 40572e-405743 TrackPopupMenu 171->177 176->177 177->170 180 405749-405760 177->180 181 4055b6 178->181 182 4055a9-4055b4 ShowWindow 178->182 179->170 183 4055ee-405606 SendMessageW * 2 179->183 184 405765-405780 SendMessageW 180->184 185 4055bc-4055c2 call 404266 181->185 182->185 183->170 184->184 186 405782-4057a5 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 184->186 185->179 188 4057a7-4057ce SendMessageW 186->188 188->188 189 4057d0-4057e4 GlobalUnlock SetClipboardData CloseClipboard 188->189 189->170
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 004054BF
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 004054CE
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040550B
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000002), ref: 00405512
                                                                                                                                                                                        • SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
                                                                                                                                                                                        • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
                                                                                                                                                                                        • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
                                                                                                                                                                                        • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
                                                                                                                                                                                        • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 004055AE
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004055CF
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 004054DD
                                                                                                                                                                                          • Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 00405621
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00405636
                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040565A
                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040565F
                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 004056A9
                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004056EE
                                                                                                                                                                                        • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 00405722
                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 00405783
                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405789
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0040579F
                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 004057D3
                                                                                                                                                                                        • SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
                                                                                                                                                                                        • CloseClipboard.USER32 ref: 004057E4
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                        • String ID: {
                                                                                                                                                                                        • API String ID: 590372296-366298937
                                                                                                                                                                                        • Opcode ID: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
                                                                                                                                                                                        • Instruction ID: bae72a1d173c3811f2fd5642bc5838002141c6bee16c4b6d0499208050eeb164
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CB12970900608FFDB119FA0DE89EAE7B79FB48354F00413AFA45A61A0CBB55E91DF58
                                                                                                                                                                                        Function 100010D0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 217COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 320 100010d0-100010fe GetVersionExW 321 10001100-10001105 320->321 322 1000110a-10001113 320->322 323 10001374-10001376 321->323 324 10001115-1000111c 322->324 325 1000112c-10001143 LoadLibraryW 322->325 326 10001122-10001127 324->326 327 10001227-10001239 LoadLibraryA 324->327 328 10001145-10001156 GetProcAddress 325->328 329 100011af 325->329 330 10001372-10001373 326->330 333 10001349-1000134e 327->333 334 1000123f-10001268 GetProcAddress * 3 327->334 331 10001158-10001164 LocalAlloc 328->331 332 1000119f 328->332 335 100011b4-100011b6 329->335 330->323 338 10001193-10001196 331->338 339 100011a4-100011ad FreeLibrary 332->339 333->330 340 1000133a-1000133d FreeLibrary 334->340 341 1000126e-10001270 334->341 336 100011b8-100011ba 335->336 337 100011bf 335->337 336->330 342 100011c2-100011c7 337->342 344 10001166-10001177 NtQuerySystemInformation 338->344 345 10001198-1000119d 338->345 339->335 343 10001343-10001347 340->343 341->340 346 10001276-10001278 341->346 347 100011c9-100011ee lstrcpynW lstrcmpiW 342->347 348 1000120f-10001213 342->348 343->333 349 10001350-10001354 343->349 344->339 350 10001179-10001188 LocalFree 344->350 345->339 346->340 351 1000127e-10001289 346->351 347->348 352 100011f0-100011f7 347->352 355 10001215-10001217 348->355 356 10001219-10001222 LocalFree 348->356 353 10001370 349->353 354 10001356-1000135a 349->354 350->345 357 1000118a-10001191 LocalAlloc 350->357 351->340 362 1000128f-100012a3 351->362 352->356 359 100011f9-1000120c call 1000103f 352->359 353->330 360 10001363-10001367 354->360 361 1000135c-10001361 354->361 355->342 356->343 357->338 359->348 360->353 364 10001369-1000136e 360->364 361->330 367 1000132b-1000132d 362->367 364->330 368 10001333-10001334 CloseHandle 367->368 369 100012a8-100012bc lstrlenW 367->369 368->340 370 100012c3-100012c7 369->370 371 100012c9-100012fc lstrlenA MultiByteToWideChar lstrcmpiW 370->371 372 100012be-100012c0 370->372 374 10001320-10001327 371->374 375 100012fe-10001305 371->375 372->371 373 100012c2 372->373 373->370 374->367 375->368 376 10001307-1000131d call 1000103f 375->376 376->374
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetVersionExW.KERNEL32(?), ref: 100010F6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972788397.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972745176.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972838462.0000000010002000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972865160.0000000010004000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_10000000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Version
                                                                                                                                                                                        • String ID: CreateToolhelp32Snapshot$KERNEL32.DLL$NTDLL.DLL$NtQuerySystemInformation$Process32First$Process32Next
                                                                                                                                                                                        • API String ID: 1889659487-877962304
                                                                                                                                                                                        • Opcode ID: 7d7e9519b5160fc9c378ed57362ed99c5f4eb730c932ba2a1b4742be338fdd70
                                                                                                                                                                                        • Instruction ID: 7912c964d9e25ca6fd3cf3701ff0e873bdc70cccdad54a87c94dbd913505c8d0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d7e9519b5160fc9c378ed57362ed99c5f4eb730c932ba2a1b4742be338fdd70
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F714671900229EFFB21DBA4CC88AEE7BF9EB483C5F114166EA15E2159E7708B44CF51
                                                                                                                                                                                        Function 6F901B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F90121B: GlobalAlloc.KERNEL32(00000040,?,6F90123B,?,6F9012DF,00000019,6F9011BE,-000000A0), ref: 6F901225
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6F901C6B
                                                                                                                                                                                        • lstrcpyW.KERNEL32(00000008,?), ref: 6F901CB3
                                                                                                                                                                                        • lstrcpyW.KERNEL32(00000808,?), ref: 6F901CBD
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F901CD0
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 6F901DB2
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 6F901DB7
                                                                                                                                                                                        • GlobalFree.KERNELBASE(?), ref: 6F901DBC
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F901FA6
                                                                                                                                                                                        • lstrcpyW.KERNEL32(?,?), ref: 6F902140
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000008), ref: 6F9021B5
                                                                                                                                                                                        • LoadLibraryW.KERNEL32(00000008), ref: 6F9021C6
                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?), ref: 6F902220
                                                                                                                                                                                        • lstrlenW.KERNEL32(00000808), ref: 6F90223A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 245916457-0
                                                                                                                                                                                        • Opcode ID: 6d17d6fec17078881b69dda04ba0a710a1993375d36f72f05f40d3cf94957081
                                                                                                                                                                                        • Instruction ID: 7bd232222bfb49d536406de96e5d909fb6d5e8b8e15315c373d75e8af1d385c9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d17d6fec17078881b69dda04ba0a710a1993375d36f72f05f40d3cf94957081
                                                                                                                                                                                        • Instruction Fuzzy Hash: 84227971D4420ADADB24AFB8C9846EEB7F8FF06319F10462ED1A5E61C0D774E6C58B50
                                                                                                                                                                                        Function 004059CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 889 4059cc-4059f2 call 405c97 892 4059f4-405a06 DeleteFileW 889->892 893 405a0b-405a12 889->893 894 405b88-405b8c 892->894 895 405a14-405a16 893->895 896 405a25-405a35 call 4062ba 893->896 897 405b36-405b3b 895->897 898 405a1c-405a1f 895->898 902 405a44-405a45 call 405bdb 896->902 903 405a37-405a42 lstrcatW 896->903 897->894 901 405b3d-405b40 897->901 898->896 898->897 904 405b42-405b48 901->904 905 405b4a-405b52 call 4065fd 901->905 907 405a4a-405a4e 902->907 903->907 904->894 905->894 913 405b54-405b68 call 405b8f call 405984 905->913 910 405a50-405a58 907->910 911 405a5a-405a60 lstrcatW 907->911 910->911 912 405a65-405a81 lstrlenW FindFirstFileW 910->912 911->912 914 405a87-405a8f 912->914 915 405b2b-405b2f 912->915 929 405b80-405b83 call 405322 913->929 930 405b6a-405b6d 913->930 917 405a91-405a99 914->917 918 405aaf-405ac3 call 4062ba 914->918 915->897 920 405b31 915->920 921 405a9b-405aa3 917->921 922 405b0e-405b1e FindNextFileW 917->922 931 405ac5-405acd 918->931 932 405ada-405ae5 call 405984 918->932 920->897 921->918 925 405aa5-405aad 921->925 922->914 928 405b24-405b25 FindClose 922->928 925->918 925->922 928->915 929->894 930->904 933 405b6f-405b7e call 405322 call 406080 930->933 931->922 934 405acf-405ad8 call 4059cc 931->934 942 405b06-405b09 call 405322 932->942 943 405ae7-405aea 932->943 933->894 934->922 942->922 944 405aec-405afc call 405322 call 406080 943->944 945 405afe-405b04 943->945 944->922 945->922
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,?,004DF000,75923420,00000000), ref: 004059F5
                                                                                                                                                                                        • lstrcatW.KERNEL32(00460250,\*.*,00460250,?,?,004DF000,75923420,00000000), ref: 00405A3D
                                                                                                                                                                                        • lstrcatW.KERNEL32(?,0040A014,?,00460250,?,?,004DF000,75923420,00000000), ref: 00405A60
                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,0040A014,?,00460250,?,?,004DF000,75923420,00000000), ref: 00405A66
                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00460250,?,?,?,0040A014,?,00460250,?,?,004DF000,75923420,00000000), ref: 00405A76
                                                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405B25
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                        • String ID: \*.*
                                                                                                                                                                                        • API String ID: 2035342205-1173974218
                                                                                                                                                                                        • Opcode ID: e10abc69e4b1c2b8094a1b2b520f663248eb98d9a150b6aedb5183a323ea6903
                                                                                                                                                                                        • Instruction ID: 3baa02bdf70247edfb0f680676f8bffda79515ede8bd61e7e13478a9eee65f3b
                                                                                                                                                                                        • Opcode Fuzzy Hash: e10abc69e4b1c2b8094a1b2b520f663248eb98d9a150b6aedb5183a323ea6903
                                                                                                                                                                                        • Instruction Fuzzy Hash: E141D430900914AACB21AB618C89ABF7778EF45369F10427FF801711D1D77CAD81DE6E
                                                                                                                                                                                        Function 004065FD Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileW.KERNEL32(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,75923420,004059EC,?,004DF000,75923420), ref: 00406608
                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00406614
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                        • Opcode ID: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
                                                                                                                                                                                        • Instruction ID: 086872f0bf6ffc0fec3bf9e050170664210a11ef237051a194e92f35cf11c1a2
                                                                                                                                                                                        • Opcode Fuzzy Hash: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 52D012315455205BC7001B386E0C85B7B599F553317158F37F46AF51E0DB758C62869D
                                                                                                                                                                                        Function 6F902AAC Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000000), ref: 6F902B6B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateSnapshotToolhelp32
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3332741929-0
                                                                                                                                                                                        • Opcode ID: f249fbeb3b19780928166aa9120eb1046496d7eba5a7ad175c76991cf16038a4
                                                                                                                                                                                        • Instruction ID: 296cbabeaef0a5b16f752b488e3f0f70ceac3d5fdd55d56833ef41942ad2a965
                                                                                                                                                                                        • Opcode Fuzzy Hash: f249fbeb3b19780928166aa9120eb1046496d7eba5a7ad175c76991cf16038a4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D4160B1808704EFEF20EF68D94175E3778EB16368F20446EE508DA1C1DB38E8959F95
                                                                                                                                                                                        Function 6F7E1CD0 Relevance: 59.7, APIs: 32, Strings: 2, Instructions: 237sleepthreadwindowCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F7E1710: GlobalAlloc.KERNEL32(00000040,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E1725
                                                                                                                                                                                          • Part of subcall function 6F7E1710: GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E1735
                                                                                                                                                                                        • FindWindowExW.USER32 ref: 6F7E1D3B
                                                                                                                                                                                        • GetDlgItem.USER32(00000000), ref: 6F7E1D44
                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,#32770,00000000), ref: 6F7E1D5E
                                                                                                                                                                                        • GetDlgItem.USER32(00000000), ref: 6F7E1D61
                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,#32770,00000000), ref: 6F7E1D7A
                                                                                                                                                                                        • GetDlgItem.USER32(00000000), ref: 6F7E1D7D
                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,#32770,00000000), ref: 6F7E1D96
                                                                                                                                                                                        • GetDlgItem.USER32(00000000), ref: 6F7E1D99
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,6F7E1AF0,?,00000000,000003EC), ref: 6F7E1DCC
                                                                                                                                                                                        • Sleep.KERNEL32(0000000A), ref: 6F7E1DEA
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 6F7E1DF3
                                                                                                                                                                                        • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6F7E1E01
                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 6F7E1E11
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,6F7E18C0), ref: 6F7E1E24
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,6F7E1910), ref: 6F7E1E39
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,6F7E1960), ref: 6F7E1E4E
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,6F7E1BD0,?,00000000,00000000), ref: 6F7E1E71
                                                                                                                                                                                        • Sleep.KERNEL32(0000000A), ref: 6F7E1E8B
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 6F7E1E94
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,6F7E18C0), ref: 6F7E1EB2
                                                                                                                                                                                        • GetWindowPlacement.USER32(?,?), ref: 6F7E1EC5
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 6F7E1ED6
                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6F7E1EE4
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,?,?,?,?,00000044), ref: 6F7E1F07
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,6F7E1840), ref: 6F7E1FA6
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 6F7E1FBB
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Long$FindItem$AllocCloseCreateGlobalHandleRectSleepThread$ClientInvalidateMessagePlacementSendShow
                                                                                                                                                                                        • String ID: #32770$,
                                                                                                                                                                                        • API String ID: 2050830551-1531211758
                                                                                                                                                                                        • Opcode ID: 931abf3ec7b78acb8fbaed584565ed73ada42dfb7b08bddc48bd5ee5402c7996
                                                                                                                                                                                        • Instruction ID: 5ca831e5033821f3cad081970be9dcff52149fa36d9cc74cc3a93625275dfe44
                                                                                                                                                                                        • Opcode Fuzzy Hash: 931abf3ec7b78acb8fbaed584565ed73ada42dfb7b08bddc48bd5ee5402c7996
                                                                                                                                                                                        • Instruction Fuzzy Hash: A2817CB9900A04AFDA10DFA5DD85DAB7BBDF7CA375B00457BF21483290D774A920DB60
                                                                                                                                                                                        Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 215 403d58-403d6a 216 403d70-403d76 215->216 217 403eab-403eba 215->217 216->217 220 403d7c-403d85 216->220 218 403f09-403f1e 217->218 219 403ebc-403f04 GetDlgItem * 2 call 404231 SetClassLongW call 40140b 217->219 224 403f20-403f23 218->224 225 403f5e-403f63 call 40427d 218->225 219->218 221 403d87-403d94 SetWindowPos 220->221 222 403d9a-403d9d 220->222 221->222 226 403db7-403dbd 222->226 227 403d9f-403db1 ShowWindow 222->227 229 403f25-403f30 call 401389 224->229 230 403f56-403f58 224->230 237 403f68-403f83 225->237 232 403dd9-403ddc 226->232 233 403dbf-403dd4 DestroyWindow 226->233 227->226 229->230 252 403f32-403f51 SendMessageW 229->252 230->225 236 4041fe 230->236 243 403dde-403dea SetWindowLongW 232->243 244 403def-403df5 232->244 240 4041db-4041e1 233->240 242 404200-404207 236->242 238 403f85-403f87 call 40140b 237->238 239 403f8c-403f92 237->239 238->239 248 403f98-403fa3 239->248 249 4041bc-4041d5 DestroyWindow EndDialog 239->249 240->236 247 4041e3-4041e9 240->247 243->242 250 403e98-403ea6 call 404298 244->250 251 403dfb-403e0c GetDlgItem 244->251 247->236 253 4041eb-4041f4 ShowWindow 247->253 248->249 254 403fa9-403ff6 call 4062dc call 404231 * 3 GetDlgItem 248->254 249->240 250->242 255 403e2b-403e2e 251->255 256 403e0e-403e25 SendMessageW IsWindowEnabled 251->256 252->242 253->236 285 404000-40403c ShowWindow KiUserCallbackDispatcher call 404253 EnableWindow 254->285 286 403ff8-403ffd 254->286 259 403e30-403e31 255->259 260 403e33-403e36 255->260 256->236 256->255 263 403e61-403e66 call 40420a 259->263 264 403e44-403e49 260->264 265 403e38-403e3e 260->265 263->250 266 403e4b-403e51 264->266 267 403e7f-403e92 SendMessageW 264->267 265->267 270 403e40-403e42 265->270 271 403e53-403e59 call 40140b 266->271 272 403e68-403e71 call 40140b 266->272 267->250 270->263 281 403e5f 271->281 272->250 282 403e73-403e7d 272->282 281->263 282->281 289 404041 285->289 290 40403e-40403f 285->290 286->285 291 404043-404071 GetSystemMenu EnableMenuItem SendMessageW 289->291 290->291 292 404073-404084 SendMessageW 291->292 293 404086 291->293 294 40408c-4040cb call 404266 call 403d39 call 4062ba lstrlenW call 4062dc SetWindowTextW call 401389 292->294 293->294 294->237 305 4040d1-4040d3 294->305 305->237 306 4040d9-4040dd 305->306 307 4040fc-404110 DestroyWindow 306->307 308 4040df-4040e5 306->308 307->240 310 404116-404143 CreateDialogParamW 307->310 308->236 309 4040eb-4040f1 308->309 309->237 311 4040f7 309->311 310->240 312 404149-4041a0 call 404231 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 310->312 311->236 312->236 317 4041a2-4041b5 ShowWindow call 40427d 312->317 319 4041ba 317->319 319->240
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 00403DB1
                                                                                                                                                                                        • DestroyWindow.USER32 ref: 00403DC5
                                                                                                                                                                                        • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403E02
                                                                                                                                                                                        • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403E1D
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403ECB
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403ED5
                                                                                                                                                                                        • SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
                                                                                                                                                                                        • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403FE6
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00404007
                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00404034
                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00404051
                                                                                                                                                                                        • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
                                                                                                                                                                                        • lstrlenW.KERNEL32(00450248,?,00450248,00000000), ref: 004040A6
                                                                                                                                                                                        • SetWindowTextW.USER32(?,00450248), ref: 004040BA
                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 004041EE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3282139019-0
                                                                                                                                                                                        • Opcode ID: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
                                                                                                                                                                                        • Instruction ID: ebd8885eb79f40fe398f9982bcc50e4b60f6275a3dc5f5776bcae5bce4ead0d0
                                                                                                                                                                                        • Opcode Fuzzy Hash: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
                                                                                                                                                                                        • Instruction Fuzzy Hash: AFC1D5B1500304ABDB206F61EE88E2B3A78FB95346F00053EF645B51F1CB799891DB6E
                                                                                                                                                                                        Function 004039AA Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 379 4039aa-4039c2 call 406694 382 4039c4-4039d4 call 406201 379->382 383 4039d6-403a0d call 406188 379->383 392 403a30-403a59 call 403c80 call 405c97 382->392 388 403a25-403a2b lstrcatW 383->388 389 403a0f-403a20 call 406188 383->389 388->392 389->388 397 403aeb-403af3 call 405c97 392->397 398 403a5f-403a64 392->398 404 403b01-403b26 LoadImageW 397->404 405 403af5-403afc call 4062dc 397->405 398->397 399 403a6a-403a92 call 406188 398->399 399->397 406 403a94-403a98 399->406 408 403ba7-403baf call 40140b 404->408 409 403b28-403b58 RegisterClassW 404->409 405->404 410 403aaa-403ab6 lstrlenW 406->410 411 403a9a-403aa7 call 405bbc 406->411 423 403bb1-403bb4 408->423 424 403bb9-403bc4 call 403c80 408->424 412 403c76 409->412 413 403b5e-403ba2 SystemParametersInfoW CreateWindowExW 409->413 417 403ab8-403ac6 lstrcmpiW 410->417 418 403ade-403ae6 call 405b8f call 4062ba 410->418 411->410 416 403c78-403c7f 412->416 413->408 417->418 422 403ac8-403ad2 GetFileAttributesW 417->422 418->397 427 403ad4-403ad6 422->427 428 403ad8-403ad9 call 405bdb 422->428 423->416 432 403bca-403be4 ShowWindow call 406624 424->432 433 403c4d-403c4e call 4053f5 424->433 427->418 427->428 428->418 440 403bf0-403c02 GetClassInfoW 432->440 441 403be6-403beb call 406624 432->441 436 403c53-403c55 433->436 438 403c57-403c5d 436->438 439 403c6f-403c71 call 40140b 436->439 438->423 442 403c63-403c6a call 40140b 438->442 439->412 445 403c04-403c14 GetClassInfoW RegisterClassW 440->445 446 403c1a-403c3d DialogBoxParamW call 40140b 440->446 441->440 442->423 445->446 450 403c42-403c4b call 4038fa 446->450 450->416
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                          • Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                        • lstrcatW.KERNEL32(004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000,75923420,004CB000,00000000), ref: 00403A2B
                                                                                                                                                                                        • lstrlenW.KERNEL32(0046AE80,?,?,?,0046AE80,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000), ref: 00403AAB
                                                                                                                                                                                        • lstrcmpiW.KERNEL32(0046AE78,.exe,0046AE80,?,?,?,0046AE80,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000), ref: 00403ABE
                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(0046AE80), ref: 00403AC9
                                                                                                                                                                                        • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004CF000), ref: 00403B12
                                                                                                                                                                                          • Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E
                                                                                                                                                                                        • RegisterClassW.USER32(00472E80), ref: 00403B4F
                                                                                                                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
                                                                                                                                                                                        • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 00403BD2
                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit20W,00472E80), ref: 00403BFE
                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit,00472E80), ref: 00403C0B
                                                                                                                                                                                        • RegisterClassW.USER32(00472E80), ref: 00403C14
                                                                                                                                                                                        • DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                        • String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$opy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe
                                                                                                                                                                                        • API String ID: 1975747703-3745905312
                                                                                                                                                                                        • Opcode ID: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
                                                                                                                                                                                        • Instruction ID: e946f9b6b947081a315c1f95bc525aa973ad4f651662e5f5477bf26fdb3bf1de
                                                                                                                                                                                        • Opcode Fuzzy Hash: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
                                                                                                                                                                                        • Instruction Fuzzy Hash: B361C8302407007ED720AF669E45E2B3A6CEB8474AF40417FF985B51E2DBBD5951CB2E
                                                                                                                                                                                        Function 6F7E1470 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,#32770,00000000), ref: 6F7E148E
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E149B
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 6F7E14B0
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E14B3
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040B), ref: 6F7E14C2
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E14C5
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040C), ref: 6F7E14D3
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E14D6
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040D), ref: 6F7E14E5
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E14E8
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040E), ref: 6F7E14F7
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E14FA
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040F), ref: 6F7E1508
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E150B
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000416), ref: 6F7E151A
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,75A923D0,?,6F7E1ADE,00000001), ref: 6F7E151D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Show$Item$Find
                                                                                                                                                                                        • String ID: #32770
                                                                                                                                                                                        • API String ID: 1227415125-463685578
                                                                                                                                                                                        • Opcode ID: 7fcdc07cb7088e10bdae2564035d03e90b6069dc9617e398b766ace994fd4645
                                                                                                                                                                                        • Instruction ID: c3bbfc29ec8395964dcdfb85faf8c024efc907b8dfdc165ce4b78f0af4fcefbf
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7fcdc07cb7088e10bdae2564035d03e90b6069dc9617e398b766ace994fd4645
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5E1169B6A007147AD920FBF59C89ED76B5CEFC6670F024477B704E31908578DC249AB4
                                                                                                                                                                                        Function 6F7E19B0 Relevance: 24.1, APIs: 16, Instructions: 111windowCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetActiveWindow.USER32 ref: 6F7E19C3
                                                                                                                                                                                        • ShowWindow.USER32(?,00000009), ref: 6F7E19DC
                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6F7E19E9
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000047), ref: 6F7E1A03
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 6F7E1A15
                                                                                                                                                                                        • GetClientRect.USER32(?,6F7E4040), ref: 6F7E1A23
                                                                                                                                                                                        • SendDlgItemMessageW.USER32(?,00000401,00000170,?,00000000), ref: 6F7E1A38
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E1A46
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000004), ref: 6F7E1A50
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E1A5B
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000), ref: 6F7E1A71
                                                                                                                                                                                        • GetActiveWindow.USER32 ref: 6F7E1A8D
                                                                                                                                                                                        • ShowWindow.USER32(?,00000009), ref: 6F7E1AA6
                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 6F7E1AB1
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000047), ref: 6F7E1AC6
                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 6F7E1AD1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Show$MetricsSystem$ActiveClientRect$DestroyItemMessageSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1218735675-0
                                                                                                                                                                                        • Opcode ID: 55141e045a3dc20d6253a1ebb3ca33c430f9cc54d04855a4f39c7562e4042292
                                                                                                                                                                                        • Instruction ID: 2711c08ec9d88eb491c2de94ad40acf88794f1dd8e579b46cd5f251987e71e05
                                                                                                                                                                                        • Opcode Fuzzy Hash: 55141e045a3dc20d6253a1ebb3ca33c430f9cc54d04855a4f39c7562e4042292
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B31A476B40704BFE620DBA4DC43FEA7765EBC5720F010467F704972C0D6B4A8648B61
                                                                                                                                                                                        Function 004062DC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209stringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 681 4062dc-4062e7 682 4062e9-4062f8 681->682 683 4062fa-406310 681->683 682->683 684 406316-406323 683->684 685 406528-40652e 683->685 684->685 686 406329-406330 684->686 687 406534-40653f 685->687 688 406335-406342 685->688 686->685 690 406541-406545 call 4062ba 687->690 691 40654a-40654b 687->691 688->687 689 406348-406354 688->689 692 406515 689->692 693 40635a-406398 689->693 690->691 697 406523-406526 692->697 698 406517-406521 692->698 695 4064b8-4064bc 693->695 696 40639e-4063a9 693->696 701 4064be-4064c4 695->701 702 4064ef-4064f3 695->702 699 4063c2 696->699 700 4063ab-4063b0 696->700 697->685 698->685 708 4063c9-4063d0 699->708 700->699 705 4063b2-4063b5 700->705 706 4064d4-4064e0 call 4062ba 701->706 707 4064c6-4064d2 call 406201 701->707 703 406502-406513 lstrlenW 702->703 704 4064f5-4064fd call 4062dc 702->704 703->685 704->703 705->699 710 4063b7-4063ba 705->710 719 4064e5-4064eb 706->719 707->719 712 4063d2-4063d4 708->712 713 4063d5-4063d7 708->713 710->699 715 4063bc-4063c0 710->715 712->713 717 406412-406415 713->717 718 4063d9-4063f7 call 406188 713->718 715->708 720 406425-406428 717->720 721 406417-406423 GetSystemDirectoryW 717->721 728 4063fc-406400 718->728 719->703 723 4064ed 719->723 726 406493-406495 720->726 727 40642a-406438 GetWindowsDirectoryW 720->727 725 406497-40649b 721->725 724 4064b0-4064b6 call 40654e 723->724 724->703 725->724 732 40649d 725->732 726->725 729 40643a-406444 726->729 727->726 730 4064a0-4064a3 728->730 731 406406-40640d call 4062dc 728->731 737 406446-406449 729->737 738 40645e-406474 SHGetSpecialFolderLocation 729->738 730->724 735 4064a5-4064ab lstrcatW 730->735 731->725 732->730 735->724 737->738 740 40644b-406452 737->740 741 406476-40648d SHGetPathFromIDListW CoTaskMemFree 738->741 742 40648f 738->742 743 40645a-40645c 740->743 741->725 741->742 742->726 743->725 743->738
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(0046AE80,00002000), ref: 0040641D
                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(0046AE80,00002000,00000000,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,?,00405359,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000), ref: 00406430
                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(00405359,00432227,00000000,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,?,00405359,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000), ref: 0040646C
                                                                                                                                                                                        • SHGetPathFromIDListW.SHELL32(00432227,0046AE80), ref: 0040647A
                                                                                                                                                                                        • CoTaskMemFree.OLE32(00432227), ref: 00406485
                                                                                                                                                                                        • lstrcatW.KERNEL32(0046AE80,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
                                                                                                                                                                                        • lstrlenW.KERNEL32(0046AE80,00000000,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,?,00405359,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000), ref: 00406503
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
                                                                                                                                                                                        • Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe, xrefs: 00406301
                                                                                                                                                                                        • \Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                                                                                                                                                                                        • String ID: Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                        • API String ID: 717251189-2711573033
                                                                                                                                                                                        • Opcode ID: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
                                                                                                                                                                                        • Instruction ID: deb4280fb9253f119c0dee44fead77f8699473dbe43bed35a1e393a154a8df3c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 87612371A00115AADF209F64DC44BAE37A5EF45318F22803FE907B62D0D77D9AA1C75E
                                                                                                                                                                                        Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 744 402edd-402f2b GetTickCount GetModuleFileNameW call 405db0 747 402f37-402f65 call 4062ba call 405bdb call 4062ba GetFileSize 744->747 748 402f2d-402f32 744->748 756 403052-403060 call 402e79 747->756 757 402f6b 747->757 749 40310f-403113 748->749 764 403062-403065 756->764 765 4030b5-4030ba 756->765 758 402f70-402f87 757->758 760 402f89 758->760 761 402f8b-402f94 call 403331 758->761 760->761 770 402f9a-402fa1 761->770 771 4030bc-4030c4 call 402e79 761->771 766 403067-40307f call 403347 call 403331 764->766 767 403089-4030b3 GlobalAlloc call 403347 call 403116 764->767 765->749 766->765 790 403081-403087 766->790 767->765 795 4030c6-4030d7 767->795 774 402fa3-402fb7 call 405d6b 770->774 775 40301d-403021 770->775 771->765 780 40302b-403031 774->780 793 402fb9-402fc0 774->793 779 403023-40302a call 402e79 775->779 775->780 779->780 786 403040-40304a 780->786 787 403033-40303d call 406787 780->787 786->758 794 403050 786->794 787->786 790->765 790->767 793->780 799 402fc2-402fc9 793->799 794->756 796 4030d9 795->796 797 4030df-4030e4 795->797 796->797 800 4030e5-4030eb 797->800 799->780 801 402fcb-402fd2 799->801 800->800 802 4030ed-403108 SetFilePointer call 405d6b 800->802 801->780 803 402fd4-402fdb 801->803 806 40310d 802->806 803->780 805 402fdd-402ffd 803->805 805->765 807 403003-403007 805->807 806->749 808 403009-40300d 807->808 809 40300f-403017 807->809 808->794 808->809 809->780 810 403019-40301b 809->810 810->780
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402EEE
                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,004E7000,00002000,?,00000006,00000008,0000000A), ref: 00402F0A
                                                                                                                                                                                          • Part of subcall function 00405DB0: GetFileAttributesW.KERNEL32(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                          • Part of subcall function 00405DB0: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,004EB000,00000000,004D7000,004D7000,004E7000,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Inst, xrefs: 00402FC2
                                                                                                                                                                                        • Null, xrefs: 00402FD4
                                                                                                                                                                                        • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
                                                                                                                                                                                        • Error launching installer, xrefs: 00402F2D
                                                                                                                                                                                        • soft, xrefs: 00402FCB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                                                                                                                                        • String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                        • API String ID: 4283519449-527102705
                                                                                                                                                                                        • Opcode ID: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
                                                                                                                                                                                        • Instruction ID: d807cc789e5c0b6659aec278a7977cb1897ccc82e3fedab9e592eb30a9b28e48
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 23511671901205ABDB20AF61DD85B9F7FACEB0431AF20403BF914B62D5C7789E818B9D
                                                                                                                                                                                        Function 6F7021CC Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 160COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 811 6f7021cc-6f7021e9 812 6f7021ee-6f7021fb 811->812 813 6f70221d 812->813 814 6f7021fd-6f70221b 812->814 813->812 815 6f70221f-6f702287 ??2@YAPAXI@Z memset ??2@YAPAXI@Z memset _wsetlocale call 6f703681 813->815 814->813 818 6f70228c-6f702294 815->818 819 6f7022f4 818->819 820 6f702296-6f70229a 818->820 822 6f7022f9-6f702306 call 6f7036d0 819->822 820->819 821 6f70229c-6f70229e 820->821 821->819 823 6f7022a0-6f7022a2 821->823 828 6f702336-6f702339 822->828 829 6f702308-6f70230f 822->829 823->819 825 6f7022a4-6f7022af call 6f6f7b30 823->825 825->819 838 6f7022b1-6f7022b8 call 6f6f7bd7 825->838 832 6f702369-6f70236c 828->832 833 6f70233b-6f702342 828->833 830 6f702311-6f702313 829->830 831 6f702325-6f702333 memset ??3@YAXPAX@Z 829->831 835 6f702316-6f70231f 830->835 831->828 836 6f702344-6f702346 833->836 837 6f702358-6f702366 memset ??3@YAXPAX@Z 833->837 835->835 839 6f702321-6f702323 835->839 840 6f702349-6f702352 836->840 837->832 838->819 844 6f7022ba-6f7022c2 call 6f6f7b97 838->844 839->831 840->840 842 6f702354-6f702356 840->842 842->837 847 6f7022c4-6f7022ce call 6f703659 844->847 848 6f7022eb-6f7022ef 844->848 847->848 852 6f7022d0-6f7022d5 847->852 848->819 850 6f7022f1-6f7022f2 848->850 850->822 852->848 853 6f7022d7-6f7022dc 852->853 853->848 854 6f7022de-6f7022e7 853->854 854->848
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F70223A
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70224B
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F702261
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702271
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F70227C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70232B
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,6F704CE4,00000000,00000000), ref: 6F702331
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70235E
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000), ref: 6F702364
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_wsetlocale
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1824925876-2007828011
                                                                                                                                                                                        • Opcode ID: 869d6d4493b796167b22caa8d828057434e866087d4fc0dcc3db9a0c8252db7b
                                                                                                                                                                                        • Instruction ID: 20ece0e9c034671dcd16c242efda15118ec1d105af0c88d7c3ff65f7b55edf79
                                                                                                                                                                                        • Opcode Fuzzy Hash: 869d6d4493b796167b22caa8d828057434e866087d4fc0dcc3db9a0c8252db7b
                                                                                                                                                                                        • Instruction Fuzzy Hash: D041D5B27007025BDB14BF68CE42B5B72FDAF9A718B01403EE915CB394EB60E851C794
                                                                                                                                                                                        Function 6F701280 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7012EF
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701300
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F701316
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701326
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F701331
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7013A5
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,?,?,00000000,00000000,00000000), ref: 6F7013AB
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7013D8
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,?,?,00000000,00000000,00000000), ref: 6F7013DE
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_wsetlocale
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1824925876-2007828011
                                                                                                                                                                                        • Opcode ID: afbc4ab26a2cc5bcb40fb8f2749a0a7fdf72206d63843867b88f859ee6b26f92
                                                                                                                                                                                        • Instruction ID: e647d7143b5d7665d594ac096d577150f84d4756b2473176d26cbf185f0905e6
                                                                                                                                                                                        • Opcode Fuzzy Hash: afbc4ab26a2cc5bcb40fb8f2749a0a7fdf72206d63843867b88f859ee6b26f92
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0841A2F2700B015BD714BB39CE46E2B72EDAF99628B05443EB901DB395EB60D8118690
                                                                                                                                                                                        Function 6F7013E6 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 92COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 953 6f7013e6-6f701409 954 6f70140b-6f701418 953->954 955 6f70141a-6f701439 954->955 956 6f70143b 954->956 955->956 956->954 957 6f70143d-6f701479 ??2@YAPAXI@Z memset _wsetlocale call 6f703681 956->957 960 6f70147e-6f70149b call 6f7035f4 call 6f703616 call 6f6f7a42 957->960 967 6f7014a2-6f7014aa call 6f7036d0 960->967 968 6f70149d 960->968 971 6f7014ac-6f7014b3 967->971 972 6f7014dd-6f7014e0 967->972 968->967 973 6f7014b5-6f7014b7 971->973 974 6f7014c9-6f7014da memset ??3@YAXPAX@Z 971->974 975 6f7014ba-6f7014c3 973->975 974->972 975->975 976 6f7014c5-6f7014c7 975->976 976->974
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F701451
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701463
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F70146E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7014CE
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,true,?,?,00000000,00000000), ref: 6F7014D4
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@_wsetlocale
                                                                                                                                                                                        • String ID: 0A$false$true
                                                                                                                                                                                        • API String ID: 1170871879-1006293617
                                                                                                                                                                                        • Opcode ID: 8d7e73ecf45e87e2c48a5cdb7de12b81fe5ba812de2d6de2dfa556a3dd4265a5
                                                                                                                                                                                        • Instruction ID: a6794be3c5d0fc997dc1b99f3a5e4cb7ae6a2b3f56eb77aaec3a372bbc73f9a5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8d7e73ecf45e87e2c48a5cdb7de12b81fe5ba812de2d6de2dfa556a3dd4265a5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 08218EF16006016FAB44BF78CE85D2B72FDEFA9268704447EF505CB3A5EA60D8219791
                                                                                                                                                                                        Function 6F7E1AF0 Relevance: 13.6, APIs: 9, Instructions: 72windowCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateDialogParamW.USER32(?,00000068,?,6F7E19B0,00000000), ref: 6F7E1B09
                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003E9), ref: 6F7E1B24
                                                                                                                                                                                        • SendMessageW.USER32(?,00000407,00000000,00000000), ref: 6F7E1B45
                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,00000000,?), ref: 6F7E1B5C
                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6F7E1B6B
                                                                                                                                                                                        • PeekMessageW.USER32(?,?,00000000,00000000,00000001), ref: 6F7E1B96
                                                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 6F7E1BA1
                                                                                                                                                                                        • WaitMessage.USER32 ref: 6F7E1BA5
                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6F7E1BAD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$SendWindow$CreateDialogDispatchItemParamPeekWait
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3171392467-0
                                                                                                                                                                                        • Opcode ID: 8b61053340d45ba02c2287c66137848142f9d6f02c0c02e704997146c9138124
                                                                                                                                                                                        • Instruction ID: 8b157ff7b43c492b0e217e9ea40b282916b9fd3010139de44c21b4548c7022c1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8b61053340d45ba02c2287c66137848142f9d6f02c0c02e704997146c9138124
                                                                                                                                                                                        • Instruction Fuzzy Hash: 76217876640700ABEA10DF648C46FA637B9B7C5730F1005B7B604A72C0E6B5E5659B64
                                                                                                                                                                                        Function 0040176F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrcatW.KERNEL32(00000000,00000000,C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe,004D3000,?,?,00000031), ref: 004017B0
                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe,C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe,00000000,00000000,C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe,004D3000,?,?,00000031), ref: 004017D5
                                                                                                                                                                                          • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                          • Part of subcall function 00405322: lstrlenW.KERNEL32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                          • Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                          • Part of subcall function 00405322: lstrcatW.KERNEL32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,0040327A,0040327A,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0), ref: 0040537D
                                                                                                                                                                                          • Part of subcall function 00405322: SetWindowTextW.USER32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe), ref: 0040538F
                                                                                                                                                                                          • Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                          • Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                          • Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                        • String ID: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe$Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe
                                                                                                                                                                                        • API String ID: 1941528284-4176722669
                                                                                                                                                                                        • Opcode ID: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
                                                                                                                                                                                        • Instruction ID: c6e8234c1d4b6e0ef99598e998ad36802638a9a190aaa2bd7459f070bf199d51
                                                                                                                                                                                        • Opcode Fuzzy Hash: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9841B471900514BACF107BA5CD45DAF3A79EF05368F20423FF422B10E1DA3C86919A6E
                                                                                                                                                                                        Function 6F7E1710 Relevance: 12.1, APIs: 8, Instructions: 90memorywindowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E1725
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E1735
                                                                                                                                                                                          • Part of subcall function 6F7E2197: lstrcpyW.KERNEL32(?,759205F4,759205F0,6F7E1746,00000000,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E21B6
                                                                                                                                                                                          • Part of subcall function 6F7E2197: GlobalFree.KERNEL32(759205F0), ref: 6F7E21C6
                                                                                                                                                                                        • DestroyIcon.USER32(?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6F7E17B0
                                                                                                                                                                                        • LoadImageW.USER32(00000000,00000000,00000001,00000020,00000020,00000010), ref: 6F7E17CB
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,00000067,00000001,00000020,00000020,00000000,00000000,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E17F2
                                                                                                                                                                                        • LoadImageW.USER32(00000000,?,?,?,?,00000000), ref: 6F7E17F9
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F7E1807
                                                                                                                                                                                        • GlobalFree.KERNELBASE(00000000), ref: 6F7E180A
                                                                                                                                                                                          • Part of subcall function 6F7E13D0: lstrcmpiW.KERNEL32(?,/TL,00000000,759205F0,6F7E1754,00000000,00000000,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E13E2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$Free$AllocImageLoad$DestroyHandleIconModulelstrcmpilstrcpy
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 385367520-0
                                                                                                                                                                                        • Opcode ID: 52981d32b3f55d6de56ea19199976c98723a2f87a5f976e19f5eefe5c1c89549
                                                                                                                                                                                        • Instruction ID: 7a9f99807de0b7efc0618a5ebe73ed9f87ea3e7e3ae0e3032ece066c0d3fe185
                                                                                                                                                                                        • Opcode Fuzzy Hash: 52981d32b3f55d6de56ea19199976c98723a2f87a5f976e19f5eefe5c1c89549
                                                                                                                                                                                        • Instruction Fuzzy Hash: C5210874640304FBE6109F659E4AFDE36ACBBCAF64F000177FA01E61C1D7F4A5208A61
                                                                                                                                                                                        Function 00403116 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CountTick$wsprintf
                                                                                                                                                                                        • String ID: '"C$... %d%%
                                                                                                                                                                                        • API String ID: 551687249-2546003125
                                                                                                                                                                                        • Opcode ID: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
                                                                                                                                                                                        • Instruction ID: f437ad28db75119c3a693f92e670aa5c34007c7df9fe8e0debaece40423bbb79
                                                                                                                                                                                        • Opcode Fuzzy Hash: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D517D71900219DBDB10DF66EA44AAE7BB8AB04356F54417FEC14B72C0CB388A51CBA9
                                                                                                                                                                                        Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
                                                                                                                                                                                        • wsprintfW.USER32 ref: 00406676
                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                        • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                        • API String ID: 2200240437-1946221925
                                                                                                                                                                                        • Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
                                                                                                                                                                                        • Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
                                                                                                                                                                                        • Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99
                                                                                                                                                                                        Function 6F902394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalFree.KERNELBASE(00000000), ref: 6F9024D6
                                                                                                                                                                                          • Part of subcall function 6F90122C: lstrcpynW.KERNEL32(00000000,?,6F9012DF,00000019,6F9011BE,-000000A0), ref: 6F90123C
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040), ref: 6F90245C
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6F902477
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4216380887-0
                                                                                                                                                                                        • Opcode ID: f9caac07f82e81eb1ebe033dc13d734b47700d68d2acbe419c8112860cc142ac
                                                                                                                                                                                        • Instruction ID: 6361a44b7674d090526641cb0d9f75fa1ee397e9072a808ca2941015db829c06
                                                                                                                                                                                        • Opcode Fuzzy Hash: f9caac07f82e81eb1ebe033dc13d734b47700d68d2acbe419c8112860cc142ac
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F41BEB0008705EFE724FF28D884A6A77B8FB9A724F004A5EE546875C1EB70E484CF65
                                                                                                                                                                                        Function 6F7E1840 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 6F7E1873
                                                                                                                                                                                        • UpdateWindow.USER32(?), ref: 6F7E187B
                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 6F7E188B
                                                                                                                                                                                        • UpdateWindow.USER32(?), ref: 6F7E1894
                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?,?), ref: 6F7E18AB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$InvalidateRectUpdate$CallProc
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3315039345-0
                                                                                                                                                                                        • Opcode ID: 7ebc94cccb00e8ccce5eb6676b355561d7aeef99b297beafe27257586996f0fb
                                                                                                                                                                                        • Instruction ID: fba6ab51fc60fb2368c29436e750f32acbd7610ae8928e1663bbbffb913ed04b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ebc94cccb00e8ccce5eb6676b355561d7aeef99b297beafe27257586996f0fb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F012C76600705ABDA10DF69DD81FA677ADEBCA771F000477F20497280C6A1F8649B70
                                                                                                                                                                                        Function 6F901777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F901B5F: GlobalFree.KERNEL32(?), ref: 6F901DB2
                                                                                                                                                                                          • Part of subcall function 6F901B5F: GlobalFree.KERNEL32(?), ref: 6F901DB7
                                                                                                                                                                                          • Part of subcall function 6F901B5F: GlobalFree.KERNELBASE(?), ref: 6F901DBC
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F901825
                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 6F9018AB
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F9018D0
                                                                                                                                                                                          • Part of subcall function 6F902352: GlobalAlloc.KERNEL32(00000040,?), ref: 6F902383
                                                                                                                                                                                          • Part of subcall function 6F902724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6F9017F6,00000000), ref: 6F9027F4
                                                                                                                                                                                          • Part of subcall function 6F9015C6: wsprintfW.USER32 ref: 6F9015F4
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$Free$Alloc$Librarywsprintf
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3962662361-3916222277
                                                                                                                                                                                        • Opcode ID: 6bed240e71c6efb3dd654231937ebc1c597de507dfdd3cdf5739dad32e1f960b
                                                                                                                                                                                        • Instruction ID: faa67b59b69691ae30951e2814a819dfb05a10ae2741ab83a01d25752fb95325
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6bed240e71c6efb3dd654231937ebc1c597de507dfdd3cdf5739dad32e1f960b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D417B714043059AEB14AF789884B9A37ACBF17328F14456EED199E1D7DBB8E2C48A60
                                                                                                                                                                                        Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                        • Opcode ID: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
                                                                                                                                                                                        • Instruction ID: 1af55e8da281c8781352e9764615226c40e2312ccaecb42dabcb88ef8baddf82
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605B61D0D7B889809B19
                                                                                                                                                                                        Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405834
                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405848
                                                                                                                                                                                        • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405867
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3449924974-0
                                                                                                                                                                                        • Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
                                                                                                                                                                                        • Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
                                                                                                                                                                                        • Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
                                                                                                                                                                                        • Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9
                                                                                                                                                                                        Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00405DFD
                                                                                                                                                                                        • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,004CB000,0040338D,004DB000,004DF000,004DF000,004DF000,004DF000,004DF000,75923420,004035D9), ref: 00405E18
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                        • String ID: nsa
                                                                                                                                                                                        • API String ID: 1716503409-2209301699
                                                                                                                                                                                        • Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
                                                                                                                                                                                        • Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64
                                                                                                                                                                                        Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040205D
                                                                                                                                                                                          • Part of subcall function 00405322: lstrlenW.KERNEL32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                          • Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                          • Part of subcall function 00405322: lstrcatW.KERNEL32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,0040327A,0040327A,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0), ref: 0040537D
                                                                                                                                                                                          • Part of subcall function 00405322: SetWindowTextW.USER32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe), ref: 0040538F
                                                                                                                                                                                          • Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                          • Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                          • Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 334405425-0
                                                                                                                                                                                        • Opcode ID: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
                                                                                                                                                                                        • Instruction ID: 3abd81b96889d1c7eb1cceed2e7b5e281284f1a6e6a9a5ff44b88a827c8e1d1c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8821B071D00205AACF20AFA5CE48A9E7A70BF04358F60413BF511B11E0DBBD8981DA6E
                                                                                                                                                                                        Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalFree.KERNEL32(008690E0), ref: 00401BE7
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00004004), ref: 00401BF9
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocFree
                                                                                                                                                                                        • String ID: C:\Users\user\Downloads\NeatReader Setup 8.1.4.exe
                                                                                                                                                                                        • API String ID: 3394109436-3670105267
                                                                                                                                                                                        • Opcode ID: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
                                                                                                                                                                                        • Instruction ID: 2ffc4b8e8b305263ff1bfe934f744a2e7f0909984677ca7ca3d2d917788d1148
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
                                                                                                                                                                                        • Instruction Fuzzy Hash: 52210A76600100ABCB10FF95CE8499E73A8EB48318BA4443FF506F32D0DB78A852DB6D
                                                                                                                                                                                        Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 004065FD: FindFirstFileW.KERNEL32(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,75923420,004059EC,?,004DF000,75923420), ref: 00406608
                                                                                                                                                                                          • Part of subcall function 004065FD: FindClose.KERNEL32(00000000), ref: 00406614
                                                                                                                                                                                        • lstrlenW.KERNEL32 ref: 00402299
                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000), ref: 004022A4
                                                                                                                                                                                        • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1486964399-0
                                                                                                                                                                                        • Opcode ID: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
                                                                                                                                                                                        • Instruction ID: edc96df04b91ed766a503f65766f364d086ea8d205cfe5bb15309c141496b913
                                                                                                                                                                                        • Opcode Fuzzy Hash: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
                                                                                                                                                                                        • Instruction Fuzzy Hash: 57117071900318A6DB10EFF98E4999EB7B8AF04344F50443FB805F72D1D6B8C4419B59
                                                                                                                                                                                        Function 6F703681 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 29stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrcpynW.KERNEL32(6F70959C,6F7095A0,6F7037D5,6F70959C,6F7037D5,?), ref: 6F7036AF
                                                                                                                                                                                        • GlobalFree.KERNELBASE(6F70959C), ref: 6F7036BF
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FreeGloballstrcpyn
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1459762280-2007828011
                                                                                                                                                                                        • Opcode ID: 5e9c1ab3031d750a6c5a2369fe80fcc88c3cfd68ec76a30d7fde28f5fd4feec0
                                                                                                                                                                                        • Instruction ID: ce1d69f03f2394af81dd278a5ba0011d4e8642e79a2d598dc489ac0835bfc8e2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e9c1ab3031d750a6c5a2369fe80fcc88c3cfd68ec76a30d7fde28f5fd4feec0
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2AF0B7B1264A04DFE751AE64C944E6673E9BF96311F00847AB465C7360DB70E810DBA1
                                                                                                                                                                                        Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,75923420,004059EC,?,004DF000,75923420,00000000), ref: 00405C48
                                                                                                                                                                                          • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
                                                                                                                                                                                          • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65
                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                          • Part of subcall function 004057F1: CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405834
                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,004D3000,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1892508949-0
                                                                                                                                                                                        • Opcode ID: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
                                                                                                                                                                                        • Instruction ID: 536d45c59d08a7b21130d9dbd5b0e10796a041e4a40079992e14d28e29d42f71
                                                                                                                                                                                        • Opcode Fuzzy Hash: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2211E231504505EBCF30AFA1CD0159F36A0EF14369B28493BFA45B22F1DB3E8A919B5E
                                                                                                                                                                                        Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseQueryValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3356406503-0
                                                                                                                                                                                        • Opcode ID: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
                                                                                                                                                                                        • Instruction ID: 1206e07bb255176646816810ef0290bee69920d7ecde6c9ccbb84b14c6b4306b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
                                                                                                                                                                                        • Instruction Fuzzy Hash: E311A771D10205EBDF14DFA4CA585AE77B4EF44348B20843FE505B72C0D6B89A41EB5E
                                                                                                                                                                                        Function 00406188 Relevance: 3.0, APIs: 2, Instructions: 44registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegQueryValueExW.KERNEL32(006F0000,006F0000,00000000,00000000,0046AE80,00004000,00000002,?,00000000,006F0000,006F0000,0046AE80,?,?,004063FC,80000002), ref: 004061CE
                                                                                                                                                                                        • RegCloseKey.KERNEL32(006F0000,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,006F0000,0046AE80,006F0000,00000000,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe), ref: 004061D9
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseQueryValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3356406503-0
                                                                                                                                                                                        • Opcode ID: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
                                                                                                                                                                                        • Instruction ID: 8659262355d6ebf2290daf59b07b2549fc881bd87fa0bb5ea6267207f8cb0b09
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
                                                                                                                                                                                        • Instruction Fuzzy Hash: 68017C72500209EADF218F51DD09EDB3BB8EF55364F01403AFE16A61A1D378DA64EBA4
                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                        • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                        • Opcode ID: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
                                                                                                                                                                                        • Instruction ID: ea42f58d7670a619ed9131e80823b54190387dbc53765a55c310ef4228f9fff3
                                                                                                                                                                                        • Opcode Fuzzy Hash: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
                                                                                                                                                                                        • Instruction Fuzzy Hash: AF0128316202109BE7095B789E04B2A3798E710315F10463FF855F62F1D6B8CC829B5C
                                                                                                                                                                                        Function 6F7E18C0 Relevance: 3.0, APIs: 2, Instructions: 27windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageW.USER32(?,00000402,?,00000000), ref: 6F7E18E9
                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?,?), ref: 6F7E1902
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CallMessageProcSendWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3536146835-0
                                                                                                                                                                                        • Opcode ID: a580907f6241b94b43bcdb6c9d27fca18c151e0a92759d962c222183f6ee400f
                                                                                                                                                                                        • Instruction ID: d68c3b398e5fd1eed3159e348ce1fda064042b0172ac65d0556df876b5316e5c
                                                                                                                                                                                        • Opcode Fuzzy Hash: a580907f6241b94b43bcdb6c9d27fca18c151e0a92759d962c222183f6ee400f
                                                                                                                                                                                        • Instruction Fuzzy Hash: C1E03075704610ABD610DE55DE49E9B7BBEFBC6770F00882BF60497280C3B0A811D760
                                                                                                                                                                                        Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000000), ref: 00401E67
                                                                                                                                                                                        • EnableWindow.USER32(00000000,00000000), ref: 00401E72
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$EnableShow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1136574915-0
                                                                                                                                                                                        • Opcode ID: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
                                                                                                                                                                                        • Instruction ID: fc8c1c2e7d4a5a8f9e35cd12a8e681b154a8316ed36a6d041aa31def844ca7e2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
                                                                                                                                                                                        • Instruction Fuzzy Hash: 61E01A72E082008FE724ABA5AA495AD77B4EB90365B20847FE211F11D1DA7858819F6A
                                                                                                                                                                                        Function 6F7E1910 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendDlgItemMessageW.USER32(?,000003EB,0000000C,00000000,?), ref: 6F7E192F
                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?,?), ref: 6F7E1947
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CallItemMessageProcSendWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2540570209-0
                                                                                                                                                                                        • Opcode ID: 8998a780d41403abf56577d77a8ea293c8f8cf937087fcf5bcb7c23612deeaba
                                                                                                                                                                                        • Instruction ID: 175933f99b90d0fd5e1e09e79088968cd9fbff93c7f6b75f00a9d28f166ae92b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8998a780d41403abf56577d77a8ea293c8f8cf937087fcf5bcb7c23612deeaba
                                                                                                                                                                                        • Instruction Fuzzy Hash: C2E09276A04200BBD510DF45CC49E8BBBBDEBCA731F01492BF54497280C270AC01C7B0
                                                                                                                                                                                        Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                          • Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
                                                                                                                                                                                          • Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
                                                                                                                                                                                          • Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2547128583-0
                                                                                                                                                                                        • Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
                                                                                                                                                                                        • Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
                                                                                                                                                                                        • Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D
                                                                                                                                                                                        Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                        • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                        • Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
                                                                                                                                                                                        • Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
                                                                                                                                                                                        • Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15
                                                                                                                                                                                        Function 00405D8B Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405DA4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                        • Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                                        • Instruction ID: fe430eedc911e7c92ce83e5abbc00e08444bb0e311ec0623c818608bfa408f6d
                                                                                                                                                                                        • Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1BD0C972504420ABD2512728AF0C89BBB95DB542717028B39FAA9A22B0CB304C568A98
                                                                                                                                                                                        Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000,00403382,004DF000,004DF000,004DF000,004DF000,75923420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1375471231-0
                                                                                                                                                                                        • Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
                                                                                                                                                                                        • Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D
                                                                                                                                                                                        Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00428200,?,00428200,?,?,00000004,00000000), ref: 00405E76
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3934441357-0
                                                                                                                                                                                        • Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                                        • Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
                                                                                                                                                                                        • Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                                        • Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4
                                                                                                                                                                                        Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                        • Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                                        • Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                                        • Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8
                                                                                                                                                                                        Function 6F902993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • VirtualProtect.KERNEL32(6F90505C,00000004,00000040,6F90504C), ref: 6F9029B1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ProtectVirtual
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 544645111-0
                                                                                                                                                                                        • Opcode ID: 0fd5949e6cac0cd9181376a0e9314ad9e398421c2c82b5c52a2c7faa7e2f2486
                                                                                                                                                                                        • Instruction ID: cc982d1a34da822b04633e894918df887aff9753378345b78a61724880dcf0ce
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0fd5949e6cac0cd9181376a0e9314ad9e398421c2c82b5c52a2c7faa7e2f2486
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7DF092F0509B80DEFB50DF2C844471E3BF4BB5A725B10856EE24CD6280E3348864DF99
                                                                                                                                                                                        Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,006F0000,0046AE80,?,006F0000,?,004061B5,?,00000000,006F0000,006F0000,0046AE80,?), ref: 0040614B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                        • Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                                        • Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
                                                                                                                                                                                        • Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14
                                                                                                                                                                                        Function 00404231 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,?,00000000), ref: 0040424B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ItemText
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3367045223-0
                                                                                                                                                                                        • Opcode ID: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
                                                                                                                                                                                        • Instruction ID: 58c8b0ee816a9f079cb4560b894257bfb9dfa06490f5d5235509ae25e2c95a64
                                                                                                                                                                                        • Opcode Fuzzy Hash: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
                                                                                                                                                                                        • Instruction Fuzzy Hash: 79C04C76148300BFD681BB55CC42F1FB79DEF94315F44C52EB59CA11E2C63A84309B26
                                                                                                                                                                                        Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                        • Opcode ID: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
                                                                                                                                                                                        • Instruction ID: 539d97cecbd0a6245bb22c05259f77f590d4a0b0d5c0f28d123e3a53dcb21da8
                                                                                                                                                                                        • Opcode Fuzzy Hash: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
                                                                                                                                                                                        • Instruction Fuzzy Hash: C6C09BB27403007BDE11CB909E49F1777545790740F18447DB348F51E0D6B4D490D61C
                                                                                                                                                                                        Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                        • Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                                        • Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
                                                                                                                                                                                        • Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                                        • Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D
                                                                                                                                                                                        Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                        • Opcode ID: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
                                                                                                                                                                                        • Instruction ID: 80b1fa8ab317a3fb83bf0bb9afc1fcb2ede285a6b5c9b7890d3d6fe7da01b763
                                                                                                                                                                                        • Opcode Fuzzy Hash: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 69B092361C4600AAEE118B50DE49F497A62E7A4702F008138B244640B0CAB200E0DB09
                                                                                                                                                                                        Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CallbackDispatcherUser
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2492992576-0
                                                                                                                                                                                        • Opcode ID: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
                                                                                                                                                                                        • Instruction ID: 6a6b83ba7992c3eb947fe44f0607646ae594aefa1fc7371f7d6a783f6fb0b7b0
                                                                                                                                                                                        • Opcode Fuzzy Hash: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4EA002754445019BCF015B50DF098057A61F7A4701B114479B5555103596314860EB19
                                                                                                                                                                                        Function 6F90121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,6F90123B,?,6F9012DF,00000019,6F9011BE,-000000A0), ref: 6F901225
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocGlobal
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3761449716-0
                                                                                                                                                                                        • Opcode ID: e79afc900a4a472439a2b98012d4e1ca9ebafacdb1b57e93d2f121c5e0912c6f
                                                                                                                                                                                        • Instruction ID: 8b9c432b677d74049030c669290a607a6017dbab703ff804736497e227e4883c
                                                                                                                                                                                        • Opcode Fuzzy Hash: e79afc900a4a472439a2b98012d4e1ca9ebafacdb1b57e93d2f121c5e0912c6f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 44B09260A084009BFE008A688906A382264A701611B044008A604D0180C12048208D28

                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                        Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404CB6
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404CC1
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
                                                                                                                                                                                        • LoadBitmapW.USER32(0000006E), ref: 00404D1E
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
                                                                                                                                                                                        • SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
                                                                                                                                                                                        • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
                                                                                                                                                                                        • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00404D94
                                                                                                                                                                                        • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
                                                                                                                                                                                        • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404EEE
                                                                                                                                                                                        • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
                                                                                                                                                                                        • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
                                                                                                                                                                                        • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
                                                                                                                                                                                        • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
                                                                                                                                                                                        • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 004050BE
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 004050CE
                                                                                                                                                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
                                                                                                                                                                                        • SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
                                                                                                                                                                                        • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 0040526D
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00405278
                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040527F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                        • String ID: $M$N
                                                                                                                                                                                        • API String ID: 1638840714-813528018
                                                                                                                                                                                        • Opcode ID: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
                                                                                                                                                                                        • Instruction ID: 350e9793ba1948ff1935c4af006ad7833f39553502bf8ecbcf91bc97059cc7bb
                                                                                                                                                                                        • Opcode Fuzzy Hash: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C0281B0900209AFDB10DFA4DD85AAE7BB5FB44314F10417AF614BA2E1C7799D92CF58
                                                                                                                                                                                        Function 00404722 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 00404771
                                                                                                                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 0040479B
                                                                                                                                                                                        • SHBrowseForFolderW.SHELL32(?), ref: 0040484C
                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00404857
                                                                                                                                                                                        • lstrcmpiW.KERNEL32(0046AE80,00450248,00000000,?,?), ref: 00404889
                                                                                                                                                                                        • lstrcatW.KERNEL32(?,0046AE80), ref: 00404895
                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7
                                                                                                                                                                                          • Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00002000,004048DE), ref: 00405917
                                                                                                                                                                                          • Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,75923420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
                                                                                                                                                                                          • Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
                                                                                                                                                                                          • Part of subcall function 0040654E: CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,75923420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
                                                                                                                                                                                          • Part of subcall function 0040654E: CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,75923420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8
                                                                                                                                                                                        • GetDiskFreeSpaceW.KERNEL32(00440218,?,?,0000040F,?,00440218,00440218,?,00000001,00440218,?,?,000003FB,?), ref: 0040496A
                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985
                                                                                                                                                                                          • Part of subcall function 00404ADE: lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
                                                                                                                                                                                          • Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
                                                                                                                                                                                          • Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                        • String ID: A
                                                                                                                                                                                        • API String ID: 2624150263-3554254475
                                                                                                                                                                                        • Opcode ID: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
                                                                                                                                                                                        • Instruction ID: aec38ac33e169681c2ce75898e964705c21f391e9d8eef84a8e49708370a7c65
                                                                                                                                                                                        • Opcode Fuzzy Hash: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0CA173B1900208ABDB11AFA5CD45AAF77B8EF84314F10847BF605B62D1D77C99418F6D
                                                                                                                                                                                        Function 6F6F7DA3 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 267encryptionCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000040,00000000,76377AD0,00000000,?,?,?,?,?,?,?,6F702E09), ref: 6F6F7E9E
                                                                                                                                                                                        • CryptProtectData.CRYPT32(?,00000000,?,00000000,00000000,?,?), ref: 6F6F7EEA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ??2@CryptDataProtect
                                                                                                                                                                                        • String ID: .po$.po
                                                                                                                                                                                        • API String ID: 2158863181-976492462
                                                                                                                                                                                        • Opcode ID: 30d28a65072f9bcdba3025d22c17a2dda95a69e1b4cf08d6295c4823d34826d3
                                                                                                                                                                                        • Instruction ID: 0ac96f6cb321447ae74413e646150e490b7e5805be3089693e683078c2fe03df
                                                                                                                                                                                        • Opcode Fuzzy Hash: 30d28a65072f9bcdba3025d22c17a2dda95a69e1b4cf08d6295c4823d34826d3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 25813832A0B2569FDB018F7898545EE7BF7AF45314B20856BE851EB290EB34DE46C780
                                                                                                                                                                                        Function 6F6F927A Relevance: 5.8, Strings: 3, Instructions: 2023COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: @$ooo$ooo
                                                                                                                                                                                        • API String ID: 0-2770192717
                                                                                                                                                                                        • Opcode ID: 0d49f6ad2eb71aae45fb5b475da65b0b2b56fc6635d67a720059122aa2dd54d8
                                                                                                                                                                                        • Instruction ID: d8a341d33004e43cc95182e99386311dbb5523c5fa9f5873dec38f83baefdddd
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0d49f6ad2eb71aae45fb5b475da65b0b2b56fc6635d67a720059122aa2dd54d8
                                                                                                                                                                                        • Instruction Fuzzy Hash: E4E2D173E106398B9B94DAE58C8409FF7B3AFC8254B1B8365CD28B7340D674AD52DAC4
                                                                                                                                                                                        Function 6F6FEB20 Relevance: 3.0, APIs: 2, Instructions: 20timeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetSystemTime.KERNEL32(?), ref: 6F6FEB2A
                                                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 6F6FEB38
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Time$System$File
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2838179519-0
                                                                                                                                                                                        • Opcode ID: 043d19566eb2905f7036775a840a6b3b1d3497101d7d0a21e52dd8369b3f53a8
                                                                                                                                                                                        • Instruction ID: a143a0c78010b572264461b554f90f9688dab8fb4c1387aa27cd5553cfec4308
                                                                                                                                                                                        • Opcode Fuzzy Hash: 043d19566eb2905f7036775a840a6b3b1d3497101d7d0a21e52dd8369b3f53a8
                                                                                                                                                                                        • Instruction Fuzzy Hash: 24E01D75A0010D97CF00EFF4D545CCF7BFD7F84258F4444A59505E3144D670E5465790
                                                                                                                                                                                        Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateInstance
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 542301482-0
                                                                                                                                                                                        • Opcode ID: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
                                                                                                                                                                                        • Instruction ID: 6590b0d0bd135a94e5278e34c2007f8374f9804fe0c2ec815525577e7f77d17f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
                                                                                                                                                                                        • Instruction Fuzzy Hash: 01414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44
                                                                                                                                                                                        Function 6F6F7CE9 Relevance: 1.6, APIs: 1, Instructions: 81encryptionCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 6F6F7D58
                                                                                                                                                                                          • Part of subcall function 6F6F7C5A: ??2@YAPAXI@Z.MSVCRT(?,00000000,?,6F6F7F18,?,?,?,?,?,?,?,?,6F702E09), ref: 6F6F7C6D
                                                                                                                                                                                          • Part of subcall function 6F6F7C5A: memcpy.MSVCRT(00000000,6F6F7F18,?,?,6F6F7F18,?,?,?,?,?,?,?,?,6F702E09), ref: 6F6F7C7C
                                                                                                                                                                                          • Part of subcall function 6F6F7C34: LocalFree.KERNEL32(?,6F6F7F62,?,?,?,?,?,?,?,?,?,?,6F702E09), ref: 6F6F7C4F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ??2@CryptDataFreeLocalUnprotectmemcpy
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4061794698-0
                                                                                                                                                                                        • Opcode ID: 0e69d660c908313f0c335e4e2cc661a0d7161d80f9e4b21110bec4c19dfd93bf
                                                                                                                                                                                        • Instruction ID: ab843dcef2b2b069a47191cceb325fff778da5b541970171d293ca40c5a06600
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0e69d660c908313f0c335e4e2cc661a0d7161d80f9e4b21110bec4c19dfd93bf
                                                                                                                                                                                        • Instruction Fuzzy Hash: 90215672A01209AFDB009FA8CCD04EEB7BAEF44364B510676EA14E7254D770AA468B91
                                                                                                                                                                                        Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                        • Opcode ID: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
                                                                                                                                                                                        • Instruction ID: 11d43fc069a5ea90b0fea77c2c23c6da8a8dfc92bb9fdb714ff4c9b8b345b962
                                                                                                                                                                                        • Opcode Fuzzy Hash: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BF08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D909B2A
                                                                                                                                                                                        Function 6F6F8F7D Relevance: 1.4, Strings: 1, Instructions: 160COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: P
                                                                                                                                                                                        • API String ID: 0-3110715001
                                                                                                                                                                                        • Opcode ID: ce22ebb969888d842e3321c91cd8f61582bb63a7135b62b350ac62c618eb0426
                                                                                                                                                                                        • Instruction ID: 743fa27e7247987183e2c707b7e5649fe2ecc713a591cf5a5d2f02acefa65b48
                                                                                                                                                                                        • Opcode Fuzzy Hash: ce22ebb969888d842e3321c91cd8f61582bb63a7135b62b350ac62c618eb0426
                                                                                                                                                                                        • Instruction Fuzzy Hash: F261D272D01229DFDB08CF89D88459DF7B6EF88314F5686AAC9157B351C7B0AA42CF84
                                                                                                                                                                                        Function 6F6FAF1C Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: h
                                                                                                                                                                                        • API String ID: 0-2439710439
                                                                                                                                                                                        • Opcode ID: 55f1aa113caf028c0dd94ad521d7a5ad700ce950304b9e831ec73daea2021cf6
                                                                                                                                                                                        • Instruction ID: 53ed8e2312bbcba9de33ecda1fb2cb66581aea81c0fd3c0b97533a3b6388e996
                                                                                                                                                                                        • Opcode Fuzzy Hash: 55f1aa113caf028c0dd94ad521d7a5ad700ce950304b9e831ec73daea2021cf6
                                                                                                                                                                                        • Instruction Fuzzy Hash: C041DF70915B108FC36CCF35D1A5962BBE2BF9C314B9289AED19B8B671DB30A845CF44
                                                                                                                                                                                        Function 6F6F8561 Relevance: .8, Instructions: 817COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 035cd7b52ccde5ff611de52b9c6b82b3f4e01b30b9272abc3bccdda80b246f7b
                                                                                                                                                                                        • Instruction ID: 99b8d621baed3f9802b0afb0f46ea06b1056e9f50e1c692e0a487dd8b1c57bd1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 035cd7b52ccde5ff611de52b9c6b82b3f4e01b30b9272abc3bccdda80b246f7b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36622E37E406299BDB50CE9AC8C05CEB3A3AFC821475B82A4CD5867715D6B4BE07DAD0
                                                                                                                                                                                        Function 00406B15 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
                                                                                                                                                                                        • Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04
                                                                                                                                                                                        Function 004072EC Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
                                                                                                                                                                                        • Instruction ID: 59779062152899835760f0dc2f5c49596223a290c6efd11eddd93cbc7c663e45
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0FC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95
                                                                                                                                                                                        Function 6F6FABA9 Relevance: .3, Instructions: 285COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: f8109723f03a72432442c16812bc8005e2abb787124ecd6c153789a95b86c716
                                                                                                                                                                                        • Instruction ID: 0d1d07f51166696feff9124952fa85594592f6f7a5a6a31ca14da31d1e03d0c5
                                                                                                                                                                                        • Opcode Fuzzy Hash: f8109723f03a72432442c16812bc8005e2abb787124ecd6c153789a95b86c716
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2AB17575B04B048FE3A8DEBAC590757F7E2BB88200F51C93D96AAC7B54DA70B416CB44
                                                                                                                                                                                        Function 6F6FA83A Relevance: .1, Instructions: 114COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 945087bf9c835ea0e0556309262576714caf11d0fd398d95ed5f9573df0ebdf8
                                                                                                                                                                                        • Instruction ID: 7cc091c7d19c757fdfd9ebf1f55ecc2410ff51a53d56b01bf9723831fa394600
                                                                                                                                                                                        • Opcode Fuzzy Hash: 945087bf9c835ea0e0556309262576714caf11d0fd398d95ed5f9573df0ebdf8
                                                                                                                                                                                        • Instruction Fuzzy Hash: C641B872D011288FDB18CFB9C98569EF7B2FF8C310F56C169D815BB225D630A9428F94
                                                                                                                                                                                        Function 6F6F840D Relevance: .1, Instructions: 110COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 7594d931358c2ae0f149c36dcf7065b5a93281dc69692259c83cda7f6321d0b7
                                                                                                                                                                                        • Instruction ID: 34e46f3f45d98ffbcb9f83c6aa08067795e4b1d7515304e8e895a69789e8a4ab
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7594d931358c2ae0f149c36dcf7065b5a93281dc69692259c83cda7f6321d0b7
                                                                                                                                                                                        • Instruction Fuzzy Hash: C03192FBB74A5347C708CEB8E8C454A73E2ABEA311709863ACE10C3355D5B5DA718558
                                                                                                                                                                                        Function 6F6F8162 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 612ecc4781bd7adc8b8133cb61aaaf50c3e50730a047228a4e069a1ac84bf1ad
                                                                                                                                                                                        • Instruction ID: a6dcb0209f5552d28e68d6e4f3f0930bf650c792fd58f0e4e2cd99f9937f8427
                                                                                                                                                                                        • Opcode Fuzzy Hash: 612ecc4781bd7adc8b8133cb61aaaf50c3e50730a047228a4e069a1ac84bf1ad
                                                                                                                                                                                        • Instruction Fuzzy Hash: EAF0FD22F245320B1B9DAC3D5F2D02A8A864AC885430BC77EED9EEB2DCE854DD2591D5
                                                                                                                                                                                        Function 6F6F1378 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 940b92d31a3313092d7a9a12d82719be9bc5d6fe5155e344a382ecfa8c79956d
                                                                                                                                                                                        • Instruction ID: 2b7dc17b2d7114d353e055f655ecdf926e1efc6612c0aad4f5ee8b1d3643742a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 940b92d31a3313092d7a9a12d82719be9bc5d6fe5155e344a382ecfa8c79956d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2DF09A2490E281CCC7498628C0A5B68BE81D7D2102F5DC1ECD2C70BB5AC9A8910DC362
                                                                                                                                                                                        Function 6F6F68DC Relevance: 54.5, APIs: 17, Strings: 14, Instructions: 252windowfileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,76334C20,?,00000000,?,6F700947,?,?,?,76334C20), ref: 6F6F6907
                                                                                                                                                                                        • GetFileSizeEx.KERNEL32(00000000,?,?,6F700947,?,?,?,76334C20,?,00000000,?,00000000), ref: 6F6F6937
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Failed to skip the offset bytes!,StdUtils::AppendToFile,00040010), ref: 6F6F6959
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,00000000,?,00000000), ref: 6F6F6963
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000004,00000000,00000000,?,6F700947,?,?,?,76334C20,?,00000000,?), ref: 6F6F69C7
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Failed to seek to the end of output file!,StdUtils::AppendToFile,00040010), ref: 6F6F6A0B
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,00000000,?,00000000), ref: 6F6F6A1B
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6F6F6A21
                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,00002000,?,00000000), ref: 6F6F6AC1
                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6F6F6AE9
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Failed to read from source file!,StdUtils::AppendToFile,00040010), ref: 6F6F6B4F
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,00000000,?,00000000), ref: 6F6F6B5F
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6F6F6B65
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Failed to open output file for writing!,StdUtils::AppendToFile,00040010), ref: 6F6F6B94
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,6F700947,?,?,?,76334C20,?,00000000,?,00000000), ref: 6F6F6BA4
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Failed to open source file for reading!,StdUtils::AppendToFile,00040010), ref: 6F6F6BD0
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,6F700947,?,?,?,76334C20,?,00000000,?,00000000), ref: 6F6F6BE0
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Failed to get size of source file!, xrefs: 6F6F6953
                                                                                                                                                                                        • StdUtils::AppendToFile, xrefs: 6F6F694E
                                                                                                                                                                                        • StdUtils::AppendToFile, xrefs: 6F6F6A00
                                                                                                                                                                                        • Failed to open source file for reading!, xrefs: 6F6F6BCA
                                                                                                                                                                                        • Failed to seek to the end of output file!, xrefs: 6F6F6A05
                                                                                                                                                                                        • StdUtils::AppendToFile, xrefs: 6F6F6B89
                                                                                                                                                                                        • Failed to write to output file!, xrefs: 6F6F6B30
                                                                                                                                                                                        • Failed to open output file for writing!, xrefs: 6F6F6B8E
                                                                                                                                                                                        • Failed to skip the offset bytes!, xrefs: 6F6F69B5
                                                                                                                                                                                        • StdUtils::AppendToFile, xrefs: 6F6F6BC5
                                                                                                                                                                                        • Failed to read from source file!, xrefs: 6F6F6B49
                                                                                                                                                                                        • StdUtils::AppendToFile, xrefs: 6F6F6B44
                                                                                                                                                                                        • StdUtils::AppendToFile, xrefs: 6F6F69B0
                                                                                                                                                                                        • StdUtils::AppendToFile, xrefs: 6F6F6B2B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandle$FileMessage$Create$ReadSizeWrite
                                                                                                                                                                                        • String ID: Failed to get size of source file!$Failed to open output file for writing!$Failed to open source file for reading!$Failed to read from source file!$Failed to seek to the end of output file!$Failed to skip the offset bytes!$Failed to write to output file!$StdUtils::AppendToFile$StdUtils::AppendToFile$StdUtils::AppendToFile$StdUtils::AppendToFile$StdUtils::AppendToFile$StdUtils::AppendToFile$StdUtils::AppendToFile
                                                                                                                                                                                        • API String ID: 724864522-2262125740
                                                                                                                                                                                        • Opcode ID: 28dfb4768e6524545269e86a1555a17329d42d106b3762eaa2c5c308446e167b
                                                                                                                                                                                        • Instruction ID: acd59421561eb6bcf0ee04870c43c7d7ddde4f0e98f3e2995c43cb388d2a74f7
                                                                                                                                                                                        • Opcode Fuzzy Hash: 28dfb4768e6524545269e86a1555a17329d42d106b3762eaa2c5c308446e167b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 219102B140A341AFDB009F24CD84A5A7BF6FF9B354F40096FF59063191DB33A9269B12
                                                                                                                                                                                        Function 6F6F5F17 Relevance: 47.5, APIs: 6, Strings: 21, Instructions: 254windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$Message_snwprintf
                                                                                                                                                                                        • String ID: Running on an unknown windows version v%u.%u!$StdUtils::get_os_friendly_name$Windows 10$Windows 2000$Windows 2000 (Server)$Windows 7$Windows 8$Windows 8.1$Windows NT 4.0$Windows NT 4.0 (Server)$Windows Server 2003$Windows Server 2008$Windows Server 2008 R2$Windows Server 2012$Windows Server 2012 R2$Windows Server 2016$Windows Vista$Windows XP$Windows XP (Server)$Windows XP (x64)$unknown
                                                                                                                                                                                        • API String ID: 3494037109-1940253508
                                                                                                                                                                                        • Opcode ID: 5504b06a28ea13f53e4c88cb6cfa40ee0ffe0e79ede8d8ebd8ae2bd4261d9e2b
                                                                                                                                                                                        • Instruction ID: 3a068024ddba65e2041d2886edb491107c6ee95bf0e01b341c60f1b4b89edf47
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5504b06a28ea13f53e4c88cb6cfa40ee0ffe0e79ede8d8ebd8ae2bd4261d9e2b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F7108E2642A0477EB08EA28DA55B57B2F27FEA730FA5403EA6048F3C5DE724D51C305
                                                                                                                                                                                        Function 6F7009F0 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 274COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F700A61
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700A72
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F700A88
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700A99
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F700AAF
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700AC0
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700B11
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,?,00000000,?,00000000,?,00000000), ref: 6F700B17
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700B49
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,?,00000000,?,00000000,?,00000000), ref: 6F700B4F
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700B81
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,?,00000000,?,00000000,?,00000000), ref: 6F700B87
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700C27
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,6F70473C,?,00000000,?,00000000), ref: 6F700C2D
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700C5B
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,6F70473C,?,00000000,?,00000000), ref: 6F700C61
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700C8F
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,6F70473C,?,00000000,?,00000000), ref: 6F700C95
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??3@$??2@
                                                                                                                                                                                        • String ID: 0A$einval$error$fallback$not_found$timeout$unknown$unsupported
                                                                                                                                                                                        • API String ID: 982000662-1868593199
                                                                                                                                                                                        • Opcode ID: 1ad5a73c98af5649c4e1c91a2e734b9f8ab013fad471c120a05efcc786b24af4
                                                                                                                                                                                        • Instruction ID: a93616989af0c4221cf04dd8b33276baa2f2a9865a0f670e961cf64caa3a4668
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ad5a73c98af5649c4e1c91a2e734b9f8ab013fad471c120a05efcc786b24af4
                                                                                                                                                                                        • Instruction Fuzzy Hash: B981A2F1600106AF9B00BF68CE96DBB77F9EF85328744453AE901DB294EB70ED119791
                                                                                                                                                                                        Function 6F700C9F Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 218COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F700D11
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700D21
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F700D37
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700D45
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700D89
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000,00000000), ref: 6F700D8F
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700DC1
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000,00000000), ref: 6F700DC7
                                                                                                                                                                                          • Part of subcall function 6F6F7664: calloc.MSVCRT ref: 6F6F76AD
                                                                                                                                                                                          • Part of subcall function 6F6F7664: GetFileAttributesW.KERNEL32(00000000,00000000), ref: 6F6F7738
                                                                                                                                                                                          • Part of subcall function 6F6F7664: free.MSVCRT ref: 6F6F7746
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700EA0
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,einval,00000000,00000000,00000000,00000000), ref: 6F700EA6
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700ED7
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000), ref: 6F700EDD
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??3@$??2@$AttributesFilecallocfree
                                                                                                                                                                                        • String ID: 0A$InvokeShellVerb: And invalid verb id has been specified!$InvokeShellVerb: Specified file name and/or path is missing!$StdUtils$StdUtils$einval$einval$error$not_found$timeout$unknown$unsupported
                                                                                                                                                                                        • API String ID: 183616607-955769117
                                                                                                                                                                                        • Opcode ID: 343041ae756da71d0894fdd16e51fe35a82de930ae3a2e0f0e5b8f2a81c755a0
                                                                                                                                                                                        • Instruction ID: c9c9112f6fc0f66150703e550bc6c84fc8b5cb68f60afdd91109d9f7ced60744
                                                                                                                                                                                        • Opcode Fuzzy Hash: 343041ae756da71d0894fdd16e51fe35a82de930ae3a2e0f0e5b8f2a81c755a0
                                                                                                                                                                                        • Instruction Fuzzy Hash: E45128F22006016BDB10BF78CF8AD7B32F8EF9A324704553AF515D7384EA50A9619291
                                                                                                                                                                                        Function 6F7E1000 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 195stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • BeginPaint.USER32(?,?,?,?,?), ref: 6F7E1012
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 6F7E1020
                                                                                                                                                                                        • CreateFontW.GDI32(0000000C,00000007,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,MS SANS SERIF), ref: 6F7E1040
                                                                                                                                                                                        • wsprintfW.USER32 ref: 6F7E10B2
                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 6F7E10BD
                                                                                                                                                                                        • GetTextExtentPoint32W.GDI32(00000000,?,00000004,?), ref: 6F7E10D2
                                                                                                                                                                                        • CreateBrushIndirect.GDI32 ref: 6F7E112B
                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 6F7E113A
                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 6F7E1147
                                                                                                                                                                                        • SetBkColor.GDI32(00000000,00FF0000), ref: 6F7E114F
                                                                                                                                                                                        • SetTextColor.GDI32(00000000,00FFFFFF), ref: 6F7E115B
                                                                                                                                                                                        • lstrlenW.KERNEL32(?,00000000,?,?,?), ref: 6F7E1169
                                                                                                                                                                                        • ExtTextOutW.GDI32(00000000,?,?,00000006,?,?,00000000), ref: 6F7E119B
                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 6F7E11BE
                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 6F7E11CF
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 6F7E11DA
                                                                                                                                                                                        • SetBkColor.GDI32(00000000,00FFFFFF), ref: 6F7E11E2
                                                                                                                                                                                        • SetTextColor.GDI32(00000000,00FF0000), ref: 6F7E11EE
                                                                                                                                                                                        • lstrlenW.KERNEL32(?,00000000,?,?,?), ref: 6F7E11FD
                                                                                                                                                                                        • ExtTextOutW.GDI32(00000000,?,00FFFFFF,00000006,?,?,00000000), ref: 6F7E122E
                                                                                                                                                                                        • DrawEdge.USER32(00000000,?,00000002,0000000F), ref: 6F7E123E
                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 6F7E1245
                                                                                                                                                                                        • EndPaint.USER32(?,?,?,?,?), ref: 6F7E124E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Text$ColorObject$CreateDeleteRect$BrushFillIndirectPaintlstrlen$BeginClientDrawEdgeExtentFontPoint32Selectwsprintf
                                                                                                                                                                                        • String ID: %u%%$MS SANS SERIF
                                                                                                                                                                                        • API String ID: 264781808-3414223049
                                                                                                                                                                                        • Opcode ID: 1d3446606dd39bdc859d997ccffb216650f045693106918793ef82716d41429b
                                                                                                                                                                                        • Instruction ID: 69dba546b10b082892ac9d4037c7b77df98432c397eb3ef494a47870f648eb09
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1d3446606dd39bdc859d997ccffb216650f045693106918793ef82716d41429b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 60614C71208701AFC780DF55C949EABBFBAFFC6720F00492AF68182260D771D9159B66
                                                                                                                                                                                        Function 6F702C9F Relevance: 42.3, APIs: 17, Strings: 7, Instructions: 261windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F702D10
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702D21
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F702D37
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702D48
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F702D5E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702D6F
                                                                                                                                                                                        • _wcsicmp.MSVCRT ref: 6F702DA1
                                                                                                                                                                                        • _wcsicmp.MSVCRT ref: 6F702DB1
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,ProtectStr() was called with bad 'scope' value!,StdUtils,00002010), ref: 6F702DD8
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702E6B
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,too_long), ref: 6F702E71
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702EC2
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000), ref: 6F702EC8
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702EFA
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000), ref: 6F702F00
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702F32
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000), ref: 6F702F38
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??3@$??2@$_wcsicmp$Message
                                                                                                                                                                                        • String ID: 0A$ProtectStr() was called with bad 'scope' value!$StdUtils$einval$encr_failed$error$too_long
                                                                                                                                                                                        • API String ID: 42717120-2661074659
                                                                                                                                                                                        • Opcode ID: d510b843a9d663d44130fbbbe2a9320c680b426278a22f94f261713ffc4ed664
                                                                                                                                                                                        • Instruction ID: 0cb4ee4675038572304af044228ef355206dd00e6e237ef942b4781a3089a385
                                                                                                                                                                                        • Opcode Fuzzy Hash: d510b843a9d663d44130fbbbe2a9320c680b426278a22f94f261713ffc4ed664
                                                                                                                                                                                        • Instruction Fuzzy Hash: CF81CEF2640505AFDB14BF28CE8ACAA73E9EF5A314704457AF911DB394EA20ED60D790
                                                                                                                                                                                        Function 6F70236D Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7023DD
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7023EE
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F702404
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702415
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F70242B
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70243E
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F702454
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702467
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F702480
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702490
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F70249B
                                                                                                                                                                                        • _wsplitpath.MSVCRT ref: 6F7024B7
                                                                                                                                                                                          • Part of subcall function 6F7036D0: GlobalAlloc.KERNEL32(00000040,?,6F70959C,6F703818,?), ref: 6F7036E6
                                                                                                                                                                                          • Part of subcall function 6F7036D0: lstrcpynW.KERNEL32(00000004,?), ref: 6F7036FC
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702502
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,?,?,00000000), ref: 6F70250E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702542
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,?,?,00000000), ref: 6F702548
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702574
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,00000000,?,?,00000000), ref: 6F70257A
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7025AA
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,00000000,?,?,00000000), ref: 6F7025B0
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7025DE
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,?,00000000), ref: 6F7025E4
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$AllocGlobal_wsetlocale_wsplitpathlstrcpyn
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 239455628-2007828011
                                                                                                                                                                                        • Opcode ID: 5eb8b19be777ebe0e683f8f762723e5cfbb4e1160096e277d3d9b2a8e167240d
                                                                                                                                                                                        • Instruction ID: fdb7f102007e81f613a72ac66d9b851655624f79220b9d96980a22d8cc841245
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5eb8b19be777ebe0e683f8f762723e5cfbb4e1160096e277d3d9b2a8e167240d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D718EB27407016BE714AF38CE96F6B32ECDF99754F04457AF906CB395EA60E81086A4
                                                                                                                                                                                        Function 004043F0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 004044A2
                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 004044D0
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 004044F1
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 0040456C
                                                                                                                                                                                        • SendMessageW.USER32(00000000), ref: 00404573
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 0040459E
                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 004045F2
                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040460E
                                                                                                                                                                                        • SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
                                                                                                                                                                                        • SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                        • String ID: N$gC@
                                                                                                                                                                                        • API String ID: 3103080414-4003572143
                                                                                                                                                                                        • Opcode ID: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
                                                                                                                                                                                        • Instruction ID: 3402c350d7270d9961c63d8365249516a5ebc70a9ec23ab72cb453283ebd69b0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7761BEB1900209BFDB009F60DD85EAA7B69FB85305F00843AF705B62D0D77D9961CF99
                                                                                                                                                                                        Function 6F700EE9 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 236COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F700F5C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700F6D
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F700F83
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700F94
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F700FAA
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700FBB
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700FE8
                                                                                                                                                                                        • ShellExecuteExW.SHELL32(?), ref: 6F701050
                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 6F701073
                                                                                                                                                                                          • Part of subcall function 6F7036D0: GlobalAlloc.KERNEL32(00000040,?,6F70959C,6F703818,?), ref: 6F7036E6
                                                                                                                                                                                          • Part of subcall function 6F7036D0: lstrcpynW.KERNEL32(00000004,?), ref: 6F7036FC
                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 6F701099
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7010DB
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,error,00000000), ref: 6F7010E1
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70110F
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,error,00000000), ref: 6F701115
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701143
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,error,00000000), ref: 6F701149
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$AllocErrorExecuteGlobalLastShell_snwprintflstrcpyn
                                                                                                                                                                                        • String ID: 0A$error$hProc:%08X$no_wait
                                                                                                                                                                                        • API String ID: 1904936257-3325457250
                                                                                                                                                                                        • Opcode ID: 18ffd82ddbed24873c25c20c0f0c0a6d81fe5be9debc2eb0ef49fb60e072cf75
                                                                                                                                                                                        • Instruction ID: e0622b711aaed96f227985eb1590283abd44113925a8c0f9b83cd088c4026f08
                                                                                                                                                                                        • Opcode Fuzzy Hash: 18ffd82ddbed24873c25c20c0f0c0a6d81fe5be9debc2eb0ef49fb60e072cf75
                                                                                                                                                                                        • Instruction Fuzzy Hash: B5718FF1600205AFDB14EF68CE86DAE77F9EF59318B04413AF915DB294EB70E9108B50
                                                                                                                                                                                        Function 6F702F45 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 208windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F702FB6
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702FC7
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F702FDD
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702FEE
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,UnprotectStr() was called with empty 'data' value!,StdUtils,00002010), ref: 6F70302C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7030C7
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,too_long,?,00000000,00000000,00000000), ref: 6F7030CD
                                                                                                                                                                                        • memset.MSVCRT ref: 6F703120
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,decr_failed,?,00000000,00000000,00000000), ref: 6F703126
                                                                                                                                                                                        • memset.MSVCRT ref: 6F703152
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,?,00000000,00000000,00000000), ref: 6F703158
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??3@$??2@$Message
                                                                                                                                                                                        • String ID: 0A$StdUtils$UnprotectStr() was called with empty 'data' value!$decr_failed$einval$error$too_long
                                                                                                                                                                                        • API String ID: 1680242409-2213145905
                                                                                                                                                                                        • Opcode ID: c4df743592e30d9a89ac5b9fdd63e55e82ea00d57319212dde98f2fec61f250d
                                                                                                                                                                                        • Instruction ID: 69dabbeb555e4892177afd13f0fb674f9f5d09fb66f952d6a95041a94a7554e2
                                                                                                                                                                                        • Opcode Fuzzy Hash: c4df743592e30d9a89ac5b9fdd63e55e82ea00d57319212dde98f2fec61f250d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2451BEF22006019F9B54BF68CE86C6B73FAEF59314704457AF902CB394EB60E9618794
                                                                                                                                                                                        Function 6F700479 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 177windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7004ED
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7004FE
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F700514
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700526
                                                                                                                                                                                        • SHFileOperationW.SHELL32(?,00000000,00000000,?,00000000), ref: 6F70057D
                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 6F7005C6
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,?,StdUtils::SHFileMove,00040010), ref: 6F7005E7
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700619
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,ERROR), ref: 6F70061F
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70064D
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,ERROR), ref: 6F700653
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$FileMessageOperation_snwprintf
                                                                                                                                                                                        • String ID: 0A$ABORTED$ERROR$Failed with error code: 0x%X$HFpo$StdUtils::SHFileMove
                                                                                                                                                                                        • API String ID: 2646227453-287741900
                                                                                                                                                                                        • Opcode ID: 0c2d79f25d3e6e6b32f2176894c822278d104ac23954ac36f8a91b159f37dd9f
                                                                                                                                                                                        • Instruction ID: 6a5ab23bdc1283764353320f36fc777d259f04e8df76796dce03461441899f13
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c2d79f25d3e6e6b32f2176894c822278d104ac23954ac36f8a91b159f37dd9f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4751B3F1600A045BDB15EF68CE45EAB77F9EF99320F04453AF915DB380EA70E9508B90
                                                                                                                                                                                        Function 6F70065D Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 176windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7006D1
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7006E2
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F7006F8
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70070A
                                                                                                                                                                                        • SHFileOperationW.SHELL32(?,00000000,00000000,?,00000000), ref: 6F700761
                                                                                                                                                                                        • _snprintf.MSVCRT ref: 6F7007AA
                                                                                                                                                                                        • MessageBoxA.USER32(00000000,?,StdUtils::SHFileCopy,00040010), ref: 6F7007C9
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7007FB
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,ERROR), ref: 6F700801
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70082F
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,ERROR), ref: 6F700835
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$FileMessageOperation_snprintf
                                                                                                                                                                                        • String ID: 0A$ABORTED$ERROR$Failed with error code: 0x%X$StdUtils::SHFileCopy
                                                                                                                                                                                        • API String ID: 3240234133-3211944386
                                                                                                                                                                                        • Opcode ID: 0519c67b114563f938c24d66353a6859de5bc33e9deb05b8efd535972d499b0a
                                                                                                                                                                                        • Instruction ID: 89fc5e50981e4bb31de9315de152eb72a095222edd736e88d3335546a826cd17
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0519c67b114563f938c24d66353a6859de5bc33e9deb05b8efd535972d499b0a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6851AFF1A006049BDF15AF68CE45E9B77F9EF99320F04553AF911DB381EA74E8208B90
                                                                                                                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                        • DrawTextW.USER32(00000000,00472EE0,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                        • String ID: F
                                                                                                                                                                                        • API String ID: 941294808-1304234792
                                                                                                                                                                                        • Opcode ID: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
                                                                                                                                                                                        • Instruction ID: 4eb8147a30471c2b969484520d7d1b1c24976f3a1718a772f7b725b3b94c1b26
                                                                                                                                                                                        • Opcode Fuzzy Hash: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C418A71800249AFCF058FA5DE459AF7BB9FF44314F00842AF991AA1A0C778D954DFA4
                                                                                                                                                                                        Function 6F7E15C0 Relevance: 24.1, APIs: 16, Instructions: 123COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetClientRect.USER32(?,75A92370), ref: 6F7E15D3
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E1605
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000000), ref: 6F7E160D
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E1634
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000001), ref: 6F7E163C
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000004), ref: 6F7E164A
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E1659
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000000), ref: 6F7E1661
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E1675
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000001), ref: 6F7E167D
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000000), ref: 6F7E1693
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E16A9
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000001), ref: 6F7E16B5
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E16CB
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000004), ref: 6F7E16D3
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,?,00000000,00000000,00000000,00000005), ref: 6F7E16F0
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MetricsSystem$ClientRectWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 233016308-0
                                                                                                                                                                                        • Opcode ID: b6ceb598cd0e174405e3e01066c734066b25ff92566e04e02cd20834294efef7
                                                                                                                                                                                        • Instruction ID: 0db2223cf91809c64eb003bdb8d0899c3eea0c0f3da09b2795f08fa242b5ec68
                                                                                                                                                                                        • Opcode Fuzzy Hash: b6ceb598cd0e174405e3e01066c734066b25ff92566e04e02cd20834294efef7
                                                                                                                                                                                        • Instruction Fuzzy Hash: FC31C773A047159FD710DF3C8D49759BBE1ABC4754F0B072AFA48E72D4D660EC088A81
                                                                                                                                                                                        Function 6F6F70C9 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 115filewindowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,?,6F701E86,00000000,00000000,00000000,00000000), ref: 6F6F7112
                                                                                                                                                                                          • Part of subcall function 6F6F6CBA: memset.MSVCRT ref: 6F6F6CCA
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,6F701E86,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6F6F7143
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,6F701E86,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6F6F716D
                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 6F6F71A8
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Failed to read data from input file!,StdUtils::HashUtils,00040010), ref: 6F6F71C9
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,6F701E86,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6F6F71DC
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Output buffer is too small to hold the hash value!,StdUtils::HashUtils,00040010), ref: 6F6F723C
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils::HashUtils, xrefs: 6F6F7215
                                                                                                                                                                                        • Failed to open input file for reading!, xrefs: 6F6F721A
                                                                                                                                                                                        • Output buffer is too small to hold the hash value!, xrefs: 6F6F7235
                                                                                                                                                                                        • StdUtils::HashUtils, xrefs: 6F6F71BE
                                                                                                                                                                                        • Failed to read data from input file!, xrefs: 6F6F71C3
                                                                                                                                                                                        • StdUtils::HashUtils, xrefs: 6F6F7230
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$CloseHandleMessageRead$Creatememset
                                                                                                                                                                                        • String ID: Failed to open input file for reading!$Failed to read data from input file!$Output buffer is too small to hold the hash value!$StdUtils::HashUtils$StdUtils::HashUtils$StdUtils::HashUtils
                                                                                                                                                                                        • API String ID: 3936598526-2413740420
                                                                                                                                                                                        • Opcode ID: 6a2b0b7f8fea41e7542ffb870e0ff395f3004bacc87cca8f08f9f5fa418bf4a5
                                                                                                                                                                                        • Instruction ID: dd78474293c5f92ee8c8d24dc7e99534fb575dfcfa8ebbd3ae4212170aba3729
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6a2b0b7f8fea41e7542ffb870e0ff395f3004bacc87cca8f08f9f5fa418bf4a5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6A41E2B110A204AADB219B18CD44FDF7BEAAF86364F00052AF555E71D0CB31A916DBA5
                                                                                                                                                                                        Function 6F6F649B Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 111COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset
                                                                                                                                                                                        • String ID: 19H1$Redstone 1$Redstone 2$Redstone 3$Redstone 4$Redstone 5$Threshold 1$Threshold 2$unknown
                                                                                                                                                                                        • API String ID: 2221118986-956141754
                                                                                                                                                                                        • Opcode ID: dcaa462375ea49c4377c34dbdd58dbf0309cbd297315c37e3835d7d60d256d28
                                                                                                                                                                                        • Instruction ID: 491708bc1247127cacc8dc5f4544916c0c1fc91a78e70b1da19e95ef80b3a29e
                                                                                                                                                                                        • Opcode Fuzzy Hash: dcaa462375ea49c4377c34dbdd58dbf0309cbd297315c37e3835d7d60d256d28
                                                                                                                                                                                        • Instruction Fuzzy Hash: D03104E324260967EA08BE149E99F4762F6FFAAB74F154029F4045F3C9DFB24E65C600
                                                                                                                                                                                        Function 6F6F73C5 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F6F7336: memset.MSVCRT ref: 6F6F734A
                                                                                                                                                                                          • Part of subcall function 6F6F7336: GetModuleHandleW.KERNEL32(shell32), ref: 6F6F735C
                                                                                                                                                                                          • Part of subcall function 6F6F7336: LoadLibraryW.KERNEL32(shell32), ref: 6F6F736E
                                                                                                                                                                                          • Part of subcall function 6F6F7305: VariantInit.OLEAUT32(?), ref: 6F6F7306
                                                                                                                                                                                          • Part of subcall function 6F6F7305: VariantClear.OLEAUT32(?), ref: 6F6F7314
                                                                                                                                                                                          • Part of subcall function 6F6F7305: SysAllocString.OLEAUT32(00000000), ref: 6F6F731E
                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 6F6F7505
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F7510
                                                                                                                                                                                        • _wcsicmp.MSVCRT ref: 6F6F7574
                                                                                                                                                                                        • SysFreeString.OLEAUT32(?), ref: 6F6F7596
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F75AF
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F75CC
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F75F4
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F75FB
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F7642
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F7649
                                                                                                                                                                                          • Part of subcall function 6F6F59FE: GetTickCount.KERNEL32 ref: 6F6F5A01
                                                                                                                                                                                          • Part of subcall function 6F6F59FE: MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,?,000005FF), ref: 6F6F5A27
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6F7654
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Variant$Clear$InitString$AllocCountFreeHandleLibraryLoadModuleMultipleObjectsTickWait_wcsicmpmemset
                                                                                                                                                                                        • String ID: }
                                                                                                                                                                                        • API String ID: 3706460367-4239843852
                                                                                                                                                                                        • Opcode ID: 0b634bc0dd19ed8d945277edb7df26a91d1803055e0f2e99766aae8e57c8e5e2
                                                                                                                                                                                        • Instruction ID: ef6d6990e888f9ff8da21f9e0d775f371a74e5a6352eea21cd5fadd5de0527db
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b634bc0dd19ed8d945277edb7df26a91d1803055e0f2e99766aae8e57c8e5e2
                                                                                                                                                                                        • Instruction Fuzzy Hash: E591F9B1508305DFDB00DFA8C888A5AB7E9FF89719F00491EF589DB250DB35E946CB52
                                                                                                                                                                                        Function 6F70012C Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 158COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F700193
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7001A9
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70026A
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,-00000002,00000000,?,00000000,00000000), ref: 6F700270
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700282
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000002), ref: 6F70028A
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7002BC
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000), ref: 6F7002C2
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??3@$??2@
                                                                                                                                                                                        • String ID: 0A$error$error$too_long
                                                                                                                                                                                        • API String ID: 982000662-4184229350
                                                                                                                                                                                        • Opcode ID: 9dcd38e9ca9574a1a3b883fd343719fef87d6e63355aad40d8c04435ea13fbeb
                                                                                                                                                                                        • Instruction ID: 47b8784f7dbd96ab31ded58d786f8f078ce4fd04f4d3f268d87e3fd912d1e179
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9dcd38e9ca9574a1a3b883fd343719fef87d6e63355aad40d8c04435ea13fbeb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3841D6B26006029FDB01BF6CDE46E9A37F9EF5A764B044165FC05CB395EB30E9218794
                                                                                                                                                                                        Function 6F7002CE Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 158COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F700336
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70034C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700417
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,-00000002,00000000,00000000,00000000), ref: 6F70041D
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70042F
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,?), ref: 6F700435
                                                                                                                                                                                          • Part of subcall function 6F7036D0: GlobalAlloc.KERNEL32(00000040,?,6F70959C,6F703818,?), ref: 6F7036E6
                                                                                                                                                                                          • Part of subcall function 6F7036D0: lstrcpynW.KERNEL32(00000004,?), ref: 6F7036FC
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700465
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000), ref: 6F70046B
                                                                                                                                                                                          • Part of subcall function 6F703560: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000000,6F700399,00000000,00000000,00000000), ref: 6F70357B
                                                                                                                                                                                          • Part of subcall function 6F703560: ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,6F700399,00000000,00000000,00000000), ref: 6F703592
                                                                                                                                                                                          • Part of subcall function 6F703560: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,000000FF,00000000,00000000,00000000,6F700399,00000000,00000000,00000000), ref: 6F7035A6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??3@$??2@ByteCharMultiWide$AllocGloballstrcpyn
                                                                                                                                                                                        • String ID: 0A$error$error$too_long
                                                                                                                                                                                        • API String ID: 416852464-4184229350
                                                                                                                                                                                        • Opcode ID: 529c6432633ac0bdf01bcb0d867df04e32ca9f4104cab11ff161abb74591597b
                                                                                                                                                                                        • Instruction ID: e6255a5089f7c0115a5241a9da9efc2735dfe1f7610a73d492b925e0295d2b68
                                                                                                                                                                                        • Opcode Fuzzy Hash: 529c6432633ac0bdf01bcb0d867df04e32ca9f4104cab11ff161abb74591597b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 31518BB16006019BDB01AF6CCE46F6A73F9EF9A324F04416AFD05CB391EB70E9218795
                                                                                                                                                                                        Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,004688E8,00000400), ref: 00405F4A
                                                                                                                                                                                          • Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
                                                                                                                                                                                          • Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57
                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,004690E8,00000400), ref: 00405F67
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405F85
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,004690E8,C0000000,00000004,004690E8,?,?,?,?,?), ref: 00405FC0
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
                                                                                                                                                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
                                                                                                                                                                                        • SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004684E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 0040606E
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075
                                                                                                                                                                                          • Part of subcall function 00405DB0: GetFileAttributesW.KERNEL32(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                          • Part of subcall function 00405DB0: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                        • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                        • API String ID: 2171350718-461813615
                                                                                                                                                                                        • Opcode ID: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
                                                                                                                                                                                        • Instruction ID: 1ccef14564d3a4e3590f6d96bf23d62cdd24cd7414a0bd79904b9c13782922cd
                                                                                                                                                                                        • Opcode Fuzzy Hash: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 08312530641B05BBC220AB659D48F6B3AACDF45744F15003FFA42F72C2EB7C98118AAD
                                                                                                                                                                                        Function 6F7E13D0 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 68stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,/TL,00000000,759205F0,6F7E1754,00000000,00000000,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E13E2
                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,/TR,?,?,?,?,00000000,6F7E1D1A), ref: 6F7E13F6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: lstrcmpi
                                                                                                                                                                                        • String ID: /BL$/BR$/CENTER$/ICON$/MODERN$/TL$/TR
                                                                                                                                                                                        • API String ID: 1586166983-1886566901
                                                                                                                                                                                        • Opcode ID: 8ffb7b3c42bfec8be8e9da05acb0259f20f7e2096b18f6a43b0855db84fe1a93
                                                                                                                                                                                        • Instruction ID: b91cfe0d1132118c4f0224730e3d74190a900e19c4931daf6ad291c7ee6c6b74
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8ffb7b3c42bfec8be8e9da05acb0259f20f7e2096b18f6a43b0855db84fe1a93
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9401626330882621E681323EBD02FCF969D4FD67B4F068177F000DA269E799DAC304A5
                                                                                                                                                                                        Function 6F6F81F5 Relevance: 19.6, APIs: 12, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F6F81CC: _getpid.MSVCRT(80000001,6F709590,6F6F82DC,80000001,6F6F8315,80000000,?,6F6FED33,?,6F70959C,?,6F6FEDAE,00000000), ref: 6F6F81CE
                                                                                                                                                                                          • Part of subcall function 6F6F81CC: clock.MSVCRT ref: 6F6F81D6
                                                                                                                                                                                          • Part of subcall function 6F6F81CC: time.MSVCRT(00000000,?,6F6FED33,?,6F70959C,?,6F6FEDAE,00000000), ref: 6F6F81E0
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8218
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F821F
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8226
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8230
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8249
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8250
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8257
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8261
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8279
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8280
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8287
                                                                                                                                                                                        • rand.MSVCRT ref: 6F6F8291
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: rand$_getpidclocktime
                                                                                                                                                                                        • String ID: *
                                                                                                                                                                                        • API String ID: 36775035-163128923
                                                                                                                                                                                        • Opcode ID: 563d229385c2b90aa95ee3c98ef8fa798e1cb75b6b8607ce6ddd295e0b1a5e52
                                                                                                                                                                                        • Instruction ID: bb6187d40dfe8150a8cf85193baa5ea81e4cc75a39ef0be837137acb50191dda
                                                                                                                                                                                        • Opcode Fuzzy Hash: 563d229385c2b90aa95ee3c98ef8fa798e1cb75b6b8607ce6ddd295e0b1a5e52
                                                                                                                                                                                        • Instruction Fuzzy Hash: 12113071E1831A4BD700EF75DC4141E7AD6BFC9154F440D3FE594C3242EA78D4598AE6
                                                                                                                                                                                        Function 6F701F11 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 141COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F701F80
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701F91
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F701FA7
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701FB7
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702036
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,einval,00000000,00000000,00000000,00000000), ref: 6F70203C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702068
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,einval,00000000,00000000,00000000,00000000), ref: 6F70206E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@
                                                                                                                                                                                        • String ID: 0A$einval$error
                                                                                                                                                                                        • API String ID: 1827009568-1764747320
                                                                                                                                                                                        • Opcode ID: 65a9b6326ffd57c3996424376cea23858aedd2d46f40514f66561887d32f79d2
                                                                                                                                                                                        • Instruction ID: a53be3b448e5db5e9e8444448a9533c154ec2ecbb0e4b44d1a4d8b620ad739bc
                                                                                                                                                                                        • Opcode Fuzzy Hash: 65a9b6326ffd57c3996424376cea23858aedd2d46f40514f66561887d32f79d2
                                                                                                                                                                                        • Instruction Fuzzy Hash: BC41B1F27017016BE714BB38CE46F5B72EC9F96364B05453AB905DB394EB60E811C694
                                                                                                                                                                                        Function 6F701DAB Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 139COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F701E1A
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701E2B
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F701E41
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701E51
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701EC7
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,einval,00000000,00000000,00000000,00000000), ref: 6F701ECD
                                                                                                                                                                                        • memset.MSVCRT ref: 6F701EFD
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000,00000000), ref: 6F701F03
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@
                                                                                                                                                                                        • String ID: 0A$einval$error
                                                                                                                                                                                        • API String ID: 1827009568-1764747320
                                                                                                                                                                                        • Opcode ID: 5da90c7d37aa3bc3be1659e631803146fed951e66a72c83994bff37500009e57
                                                                                                                                                                                        • Instruction ID: e0b7db8b978ceb2bef26e9c94d90f9bab84e62690bdbd3ae0f5f4be2a29ba299
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5da90c7d37aa3bc3be1659e631803146fed951e66a72c83994bff37500009e57
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7341E6F26007016BDB15BB38CE4AD6F77EDEF9A628B04453EF415CB395EB60E8118690
                                                                                                                                                                                        Function 6F702878 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 130COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7028E8
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7028F9
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F70290F
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70291D
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F702928
                                                                                                                                                                                        • _wsplitpath.MSVCRT ref: 6F702940
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702975
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,00000000), ref: 6F70297B
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7029AA
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000), ref: 6F7029B0
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_wsetlocale_wsplitpath
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1271169891-2007828011
                                                                                                                                                                                        • Opcode ID: 2db838dc24c706a56c42bd97c5bc5d2170f4f260fb42e8dd87f2e4d22f50f505
                                                                                                                                                                                        • Instruction ID: 7870e2ac7457e15963fe5c99a5cafd60fb100c3b0640235a9385dd0b3b9741d5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2db838dc24c706a56c42bd97c5bc5d2170f4f260fb42e8dd87f2e4d22f50f505
                                                                                                                                                                                        • Instruction Fuzzy Hash: A83183F26006056FEB14AF28CE86D6B73ECEF95624704407EF905D7395DA60EC6187A4
                                                                                                                                                                                        Function 6F702732 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 130COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7027A2
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7027B3
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F7027C9
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7027D7
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F7027E2
                                                                                                                                                                                        • _wsplitpath.MSVCRT ref: 6F7027FA
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70282F
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,00000000), ref: 6F702835
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702864
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000), ref: 6F70286A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_wsetlocale_wsplitpath
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1271169891-2007828011
                                                                                                                                                                                        • Opcode ID: cb2a9a93f19bc34742b8a89158722109dfcb03f6eb82835a3a415024ad269898
                                                                                                                                                                                        • Instruction ID: 3e1f5ea3d0b2b8ac71d466e150383cd76530c14bb07c023f908a9cfbd97d4935
                                                                                                                                                                                        • Opcode Fuzzy Hash: cb2a9a93f19bc34742b8a89158722109dfcb03f6eb82835a3a415024ad269898
                                                                                                                                                                                        • Instruction Fuzzy Hash: DD3183F26005056F9B14AF28CE86D6B73EDEF9A624704417EF905C7395EA60EC6187A0
                                                                                                                                                                                        Function 6F7025EC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 130COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F70265C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70266D
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F702683
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702691
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F70269C
                                                                                                                                                                                        • _wsplitpath.MSVCRT ref: 6F7026B4
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7026E9
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,00000000), ref: 6F7026EF
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70271E
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000), ref: 6F702724
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_wsetlocale_wsplitpath
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1271169891-2007828011
                                                                                                                                                                                        • Opcode ID: 9f39843b458527cc7254201328165c37b0ac2105e4cf2737c90c4c088c4e53f9
                                                                                                                                                                                        • Instruction ID: 5539f357aa71a21ea08b10f3e3fb903bfcab321d8029bb59152cd4322835073d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f39843b458527cc7254201328165c37b0ac2105e4cf2737c90c4c088c4e53f9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D3183F22006056F9B14AF28CD86D6B77EDEF9A624704407AFA05C7395EA60EC6187A0
                                                                                                                                                                                        Function 6F7029BE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 130COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F702A2E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702A3F
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F702A55
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702A63
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F702A6E
                                                                                                                                                                                        • _wsplitpath.MSVCRT ref: 6F702A86
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702ABB
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,00000000), ref: 6F702AC1
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702AF0
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000), ref: 6F702AF6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_wsetlocale_wsplitpath
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1271169891-2007828011
                                                                                                                                                                                        • Opcode ID: 3d6b02e9def267042b8474a862919bfab9b3aa20d30e4a295683a5987658133e
                                                                                                                                                                                        • Instruction ID: 2eedfdb048d89071d441f3cc49b42f3fefe50649facf300d97ff5c2c30113862
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3d6b02e9def267042b8474a862919bfab9b3aa20d30e4a295683a5987658133e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 733172F22005056F9B14AF28CE86D6B73EDEF95624704807AF905C7395EE60EC6186A0
                                                                                                                                                                                        Function 6F6FF014 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 111COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FF095
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF0CF
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF0F4
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00000000,00000000), ref: 6F6FF0FA
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF11C
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,00000000), ref: 6F6FF124
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00000000,error), ref: 6F6FF0D5
                                                                                                                                                                                          • Part of subcall function 6F7036D0: GlobalAlloc.KERNEL32(00000040,?,6F70959C,6F703818,?), ref: 6F7036E6
                                                                                                                                                                                          • Part of subcall function 6F7036D0: lstrcpynW.KERNEL32(00000004,?), ref: 6F7036FC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ??3@memset$??2@AllocGloballstrcpyn
                                                                                                                                                                                        • String ID: 0A$einval$error$too_long
                                                                                                                                                                                        • API String ID: 4029303160-3859856511
                                                                                                                                                                                        • Opcode ID: a7ed8605d83d327bce0a6d29a7acebfd39af531b83dbabc978c75b995ad812fb
                                                                                                                                                                                        • Instruction ID: 1e6b0498091ae50dc49cde326cbe0ff4e5e34b749576f12c482036fdbde14ec8
                                                                                                                                                                                        • Opcode Fuzzy Hash: a7ed8605d83d327bce0a6d29a7acebfd39af531b83dbabc978c75b995ad812fb
                                                                                                                                                                                        • Instruction Fuzzy Hash: A031AFB1600605ABDB01AF68CD95E5737FAEF96324F00817AB915DB391EB30D822CB90
                                                                                                                                                                                        Function 6F701153 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 109synchronizationCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7011BC
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7011CE
                                                                                                                                                                                        • swscanf.MSVCRT ref: 6F7011EA
                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 6F701208
                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 6F701219
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6F701228
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70126D
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,error), ref: 6F701273
                                                                                                                                                                                          • Part of subcall function 6F7036D0: GlobalAlloc.KERNEL32(00000040,?,6F70959C,6F703818,?), ref: 6F7036E6
                                                                                                                                                                                          • Part of subcall function 6F7036D0: lstrcpynW.KERNEL32(00000004,?), ref: 6F7036FC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@AllocCloseCodeExitGlobalHandleObjectProcessSingleWaitlstrcpynswscanf
                                                                                                                                                                                        • String ID: 0A$error$hProc:%X
                                                                                                                                                                                        • API String ID: 43933247-2066092378
                                                                                                                                                                                        • Opcode ID: 6dcf8b531d545e4e2d4eb4f1c25ee3e056f9449837044b47d55b050dec2da8a3
                                                                                                                                                                                        • Instruction ID: 4cd1314e6a7d348059786a4dad0235d5279ea471736115137bb7cdbe53a50062
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6dcf8b531d545e4e2d4eb4f1c25ee3e056f9449837044b47d55b050dec2da8a3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A3192F1601606AFDB01EF68DE85D9A37ECFF5A228B44413AF915D6290EB70D9308B91
                                                                                                                                                                                        Function 6F70083F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 166COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7008B2
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7008C3
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F7008D9
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7008E9
                                                                                                                                                                                          • Part of subcall function 6F7036D0: GlobalAlloc.KERNEL32(00000040,?,6F70959C,6F703818,?), ref: 6F7036E6
                                                                                                                                                                                          • Part of subcall function 6F7036D0: lstrcpynW.KERNEL32(00000004,?), ref: 6F7036FC
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7009AC
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,error,?,00000000,?,00000000), ref: 6F7009B2
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7009E0
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,error,?,00000000,?,00000000), ref: 6F7009E6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$AllocGloballstrcpyn
                                                                                                                                                                                        • String ID: 0A$error
                                                                                                                                                                                        • API String ID: 1680118246-3130266295
                                                                                                                                                                                        • Opcode ID: dcfee56b32d58491ed4883694dc921fd11f0d2d624bc12ee14bcee5d1a83c3fc
                                                                                                                                                                                        • Instruction ID: c049e18b923c1b81514f51aabeddf92ca52a0086ab5d4d40db582156ffd59c3e
                                                                                                                                                                                        • Opcode Fuzzy Hash: dcfee56b32d58491ed4883694dc921fd11f0d2d624bc12ee14bcee5d1a83c3fc
                                                                                                                                                                                        • Instruction Fuzzy Hash: D1519FF1A106099FEB04EF68CE85C9E77F9EF49324B04457AE915D7290EB30AE11CB90
                                                                                                                                                                                        Function 6F6FF836 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 160COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FF8A9
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF8BA
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F6FF8D0
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF8DE
                                                                                                                                                                                        • swscanf.MSVCRT ref: 6F6FF926
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF992
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,?,?,?), ref: 6F6FF998
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF9C6
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,?,?,?), ref: 6F6FF9CC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$swscanf
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 569297226-2007828011
                                                                                                                                                                                        • Opcode ID: efef1e225e83d8d6fd9be6872f0742462972f5786249cfa4bf2feeff2b179203
                                                                                                                                                                                        • Instruction ID: d9934ab9d4cdb30e46d3e31ffcfacc3d1f3eaaa1c4a629a3be889e29be674641
                                                                                                                                                                                        • Opcode Fuzzy Hash: efef1e225e83d8d6fd9be6872f0742462972f5786249cfa4bf2feeff2b179203
                                                                                                                                                                                        • Instruction Fuzzy Hash: 215180B1601605AFDB00AF68CD85C9E77F9EF59214704453AE915D7394EB30DD21CB90
                                                                                                                                                                                        Function 6F6FF6BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FF72C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF73D
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F6FF753
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF761
                                                                                                                                                                                        • swscanf.MSVCRT ref: 6F6FF79A
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF7F2
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,?,?), ref: 6F6FF7F8
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF826
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,?,?), ref: 6F6FF82C
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$swscanf
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 569297226-2007828011
                                                                                                                                                                                        • Opcode ID: a3d5a5f3bc678e821589ce4c5c54ea42bc072c79576d90cc60640482f655bd53
                                                                                                                                                                                        • Instruction ID: 7d0ded87faf94f8645c97dff6a8327015a7e9ee7249b0a652a3dbb716f109246
                                                                                                                                                                                        • Opcode Fuzzy Hash: a3d5a5f3bc678e821589ce4c5c54ea42bc072c79576d90cc60640482f655bd53
                                                                                                                                                                                        • Instruction Fuzzy Hash: B9419DB2601605AFDB04AF68DD86CAB77EDEF59214704453AF915CB394EB30ED21CBA0
                                                                                                                                                                                        Function 6F6FF3FA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 138COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FF468
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF479
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F6FF48F
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF49E
                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 6F6FF4D4
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF521
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000), ref: 6F6FF527
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF554
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000), ref: 6F6FF55A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_snwprintf
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 995522934-2007828011
                                                                                                                                                                                        • Opcode ID: c3e574a88cf686f4fc8655894c0dc3b7babbc0250fb84ed85714d8ae2f1b8f28
                                                                                                                                                                                        • Instruction ID: 45f9a6a45e81d98bb4393a78b894f20e59caaf59c863e136c8cccfb004848c6e
                                                                                                                                                                                        • Opcode Fuzzy Hash: c3e574a88cf686f4fc8655894c0dc3b7babbc0250fb84ed85714d8ae2f1b8f28
                                                                                                                                                                                        • Instruction Fuzzy Hash: 90418EB1701B015BDB14AF78CD46F6B32FDAFA9324B05413AF905CB395EB60E8218B90
                                                                                                                                                                                        Function 6F6FF563 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FF5D3
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF5E4
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000), ref: 6F6FF5FA
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF608
                                                                                                                                                                                        • swscanf.MSVCRT ref: 6F6FF632
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF677
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,?), ref: 6F6FF67D
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF6AB
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,?), ref: 6F6FF6B1
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$swscanf
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 569297226-2007828011
                                                                                                                                                                                        • Opcode ID: d23afbb36358a1540d6bd34ed9f4633b664ab03a625b8d426463c55138cda9b5
                                                                                                                                                                                        • Instruction ID: 1888da582063f18a4124065127dae1ab2fd1a148b0166c1bb7ebe0385b143f92
                                                                                                                                                                                        • Opcode Fuzzy Hash: d23afbb36358a1540d6bd34ed9f4633b664ab03a625b8d426463c55138cda9b5
                                                                                                                                                                                        • Instruction Fuzzy Hash: D341B3B26016055FDB14AF28CD86CAB77EDEF59224705413AF905CB3A4EB30ED21CB90
                                                                                                                                                                                        Function 6F6FF29C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 135COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FF30A
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF31B
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F6FF331
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF340
                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 6F6FF36B
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF3B8
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000), ref: 6F6FF3BE
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF3EB
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000), ref: 6F6FF3F1
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_snwprintf
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 995522934-2007828011
                                                                                                                                                                                        • Opcode ID: cfce9bf112b288da65e4423d75e9316cd270ff36c4064c8b52c508fcc005c585
                                                                                                                                                                                        • Instruction ID: 13e96e10baac0be61c1669c898a93262da4369f876f066452af0a9b1e12a36c9
                                                                                                                                                                                        • Opcode Fuzzy Hash: cfce9bf112b288da65e4423d75e9316cd270ff36c4064c8b52c508fcc005c585
                                                                                                                                                                                        • Instruction Fuzzy Hash: 93418DB2701A015BDB14AF78CD46F6B32FDAF99724B05453AF905CB394EB60E8218B90
                                                                                                                                                                                        Function 6F702077 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 132COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F7020E5
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7020F6
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F70210C
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70211E
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F702129
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702188
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,6F704CDC,00000000,00000000), ref: 6F70218E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F7021BC
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00002000,6F704CDC,00000000,00000000), ref: 6F7021C2
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_wsetlocale
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1824925876-2007828011
                                                                                                                                                                                        • Opcode ID: 5b42ec1b1a5a0f849119b4352fc844213ef23469628cb488bfd4b8da3c5c17f9
                                                                                                                                                                                        • Instruction ID: d3efa60e55907808be72972b196c5df19884b26a8955ab51ae96fe77d2128e3f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b42ec1b1a5a0f849119b4352fc844213ef23469628cb488bfd4b8da3c5c17f9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3441A3B23006016BDB15AF28CE46D6B77EDEF99324704843AF906CB395DA70E811CBD0
                                                                                                                                                                                        Function 6F6FF149 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FF1B8
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF1C9
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F6FF1DF
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF1EE
                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 6F6FF20E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF25B
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000), ref: 6F6FF261
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FF28E
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000), ref: 6F6FF294
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@$_snwprintf
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 995522934-2007828011
                                                                                                                                                                                        • Opcode ID: 0770a1b52ce51a5bf6623c05667c5aaacc5ee5716ab2c131755eed0381b6af9a
                                                                                                                                                                                        • Instruction ID: a80b758a827e6360a95a8c5393e8c95e0f6620d0739e9a2de2d55b62655566bd
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0770a1b52ce51a5bf6623c05667c5aaacc5ee5716ab2c131755eed0381b6af9a
                                                                                                                                                                                        • Instruction Fuzzy Hash: FC317FB1701B015BE7149B78CE86F6776FDAF9A624F04453EF905CB394EB60E8218790
                                                                                                                                                                                        Function 6F6F6CBA Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 101windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F6CCA
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Blake2_Init internal error, going to abort!,StdUtils::HashFunction_Init,00040010), ref: 6F6F6E50
                                                                                                                                                                                        • abort.MSVCRT(?,Blake2_Init internal error, going to abort!,StdUtils::HashFunction_Init,00040010), ref: 6F6F6E56
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,The specified hash type is unknown/unsupported!,StdUtils::HashUtils,00040010), ref: 6F6F6E79
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • The specified hash type is unknown/unsupported!, xrefs: 6F6F6E73
                                                                                                                                                                                        • StdUtils::HashFunction_Init, xrefs: 6F6F6E45
                                                                                                                                                                                        • 8Spo, xrefs: 6F6F6DAE
                                                                                                                                                                                        • XSpo, xrefs: 6F6F6D83
                                                                                                                                                                                        • Blake2_Init internal error, going to abort!, xrefs: 6F6F6E4A
                                                                                                                                                                                        • StdUtils::HashUtils, xrefs: 6F6F6E6E
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$abortmemset
                                                                                                                                                                                        • String ID: 8Spo$Blake2_Init internal error, going to abort!$StdUtils::HashFunction_Init$StdUtils::HashUtils$The specified hash type is unknown/unsupported!$XSpo
                                                                                                                                                                                        • API String ID: 2093300295-2810946067
                                                                                                                                                                                        • Opcode ID: 4c5baed63056d2751215461c5259398c9435222a2807bef123146da0a710f74d
                                                                                                                                                                                        • Instruction ID: d67456c3d54781470b3459b845cf7532befaf75b2e4d4826a0b84d7b7a74bbe0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4c5baed63056d2751215461c5259398c9435222a2807bef123146da0a710f74d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 684142F1446B00DBE3209F399945BC2FBF6BB16314F408A1ED5DE9B280CF7265469B51
                                                                                                                                                                                        Function 6F6FEEFD Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 95windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000001), ref: 6F6FEF7B
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FEF89
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FEFCF
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,?,EOL), ref: 6F6FEFD5
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,RandList() was called with bad arguments!,StdUtils,00002010), ref: 6F6FEFFF
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@Message
                                                                                                                                                                                        • String ID: 0A$EOL$RandList() was called with bad arguments!$StdUtils$einval
                                                                                                                                                                                        • API String ID: 2843372388-2113792628
                                                                                                                                                                                        • Opcode ID: a1b09b18ad09214acff62c97194039c9026b6c1a956bea35cf71c37664be6f6a
                                                                                                                                                                                        • Instruction ID: 88546a268b81f31ef7a04d8732bbf21fbdcca97a7ba94c30444dbaf582a2889a
                                                                                                                                                                                        • Opcode Fuzzy Hash: a1b09b18ad09214acff62c97194039c9026b6c1a956bea35cf71c37664be6f6a
                                                                                                                                                                                        • Instruction Fuzzy Hash: F031D3B16026065FEB11AF24C944F4A7BF6AF69324F10006AF904D7281DB70E862CB90
                                                                                                                                                                                        Function 6F7E1BD0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindWindowExW.USER32(?,00000000,#32770,00000000), ref: 6F7E1BEB
                                                                                                                                                                                        • SendMessageW.USER32(?,00000407,00000000,00000000), ref: 6F7E1C2D
                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,00000000,?), ref: 6F7E1C44
                                                                                                                                                                                        • SendMessageW.USER32(?,00000402,00000001,00000000), ref: 6F7E1C56
                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6F7E1C64
                                                                                                                                                                                        • PeekMessageW.USER32(?,?,00000000,00000000,00000001), ref: 6F7E1C92
                                                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 6F7E1C9D
                                                                                                                                                                                        • WaitMessage.USER32 ref: 6F7E1CA1
                                                                                                                                                                                        • IsWindow.USER32(?), ref: 6F7E1CAA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$SendWindow$DispatchFindPeekWait
                                                                                                                                                                                        • String ID: #32770
                                                                                                                                                                                        • API String ID: 850096679-463685578
                                                                                                                                                                                        • Opcode ID: daf92fe5ed50fd506e84dff81c49c661355d89d1646774e8c5a912c08ef69854
                                                                                                                                                                                        • Instruction ID: c7bfef3931cf45fb1014917a5ee89373a68bb1208c2371983441d535f16ef09a
                                                                                                                                                                                        • Opcode Fuzzy Hash: daf92fe5ed50fd506e84dff81c49c661355d89d1646774e8c5a912c08ef69854
                                                                                                                                                                                        • Instruction Fuzzy Hash: 25218676640700A7EB10DF698E42FA63BA9B7CA770F100577B700DB1D0D6B5F4219764
                                                                                                                                                                                        Function 6F6F6819 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(6F6F0000,?,00000104,?,?,?), ref: 6F6F6844
                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 6F6F687C
                                                                                                                                                                                        • FatalAppExitW.KERNEL32(00000000,?), ref: 6F6F6892
                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(000000FF), ref: 6F6F6896
                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 6F6F6899
                                                                                                                                                                                        • FatalAppExitW.KERNEL32(00000000,This is not a valid Win32 application!), ref: 6F6F68A2
                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(000000FF), ref: 6F6F68A6
                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 6F6F68A9
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • This is not a valid Win32 application!, xrefs: 6F6F689B
                                                                                                                                                                                        • %s is not a valid Win32 application!, xrefs: 6F6F686B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Process$CurrentExitFatalTerminate$FileModuleName_snwprintf
                                                                                                                                                                                        • String ID: %s is not a valid Win32 application!$This is not a valid Win32 application!
                                                                                                                                                                                        • API String ID: 3892063871-1928030974
                                                                                                                                                                                        • Opcode ID: 98c30736804b498a7d2b70d9b885f5a69326f433e1ec72c2fda228d095e02b74
                                                                                                                                                                                        • Instruction ID: 86dcd88fd9520a5321c8251acde7f6b50dae79310489b16083537f36d6b85bd8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 98c30736804b498a7d2b70d9b885f5a69326f433e1ec72c2fda228d095e02b74
                                                                                                                                                                                        • Instruction Fuzzy Hash: BE01B5B151021C6AEB10BA61CC48FA7376DEF86374F4001A9FB24E21C1EA71E995CA75
                                                                                                                                                                                        Function 6F6FFE76 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FFEE1
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFEF3
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F6FFEFE
                                                                                                                                                                                        • iswcntrl.MSVCRT ref: 6F6FFF1D
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFFCD
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,invalid,00000000,00000000), ref: 6F6FFFD3
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@_wsetlocaleiswcntrl
                                                                                                                                                                                        • String ID: 0A$<>"|?*$invalid
                                                                                                                                                                                        • API String ID: 1770610939-2517845156
                                                                                                                                                                                        • Opcode ID: 3554271da1cd614bb96d7510aeb2aed98897fb73b44133377ab82ebdbd6d23f8
                                                                                                                                                                                        • Instruction ID: 8285843e1de5d9de80a475994350df3f013b859dc9a56047e0f5f590ce124ac3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3554271da1cd614bb96d7510aeb2aed98897fb73b44133377ab82ebdbd6d23f8
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4441C4B16026125BDB20AF28C98197673FAEF9A334700463EF461CB2D4EF60D892D751
                                                                                                                                                                                        Function 6F6FFD45 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 110COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FFDB0
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFDC2
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F6FFDCD
                                                                                                                                                                                        • iswcntrl.MSVCRT ref: 6F6FFDE8
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFE63
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,invalid,00000000,00000000), ref: 6F6FFE69
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@_wsetlocaleiswcntrl
                                                                                                                                                                                        • String ID: 0A$<>:"/\|?*$invalid
                                                                                                                                                                                        • API String ID: 1770610939-3758005444
                                                                                                                                                                                        • Opcode ID: 84cabf87a3af3abfe39644f2c3d8b50cbe4be8d1d9f9c0f31b9e6efc76c3d2b8
                                                                                                                                                                                        • Instruction ID: f3be3e6da5ff02ca3f10d2e3b7e078f1898fabf15e8cc80ac6c4627e84b615c8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 84cabf87a3af3abfe39644f2c3d8b50cbe4be8d1d9f9c0f31b9e6efc76c3d2b8
                                                                                                                                                                                        • Instruction Fuzzy Hash: B131E6B5601602ABDB14AF28CC8597673F9EFDA724700463EF542DB391EF20D862D750
                                                                                                                                                                                        Function 6F6FE664 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F6F59FE: GetTickCount.KERNEL32 ref: 6F6F5A01
                                                                                                                                                                                          • Part of subcall function 6F6F59FE: MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,?,000005FF), ref: 6F6F5A27
                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 6F6FE694
                                                                                                                                                                                          • Part of subcall function 6F6F7305: VariantInit.OLEAUT32(?), ref: 6F6F7306
                                                                                                                                                                                          • Part of subcall function 6F6F7305: VariantClear.OLEAUT32(?), ref: 6F6F7314
                                                                                                                                                                                          • Part of subcall function 6F6F7305: SysAllocString.OLEAUT32(00000000), ref: 6F6F731E
                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 6F6FE6C2
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6FE6CF
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6FE736
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6FE73D
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6FE744
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6FE74B
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6FE752
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Variant$Clear$Init$AllocCountMultipleObjectsStringTickWait
                                                                                                                                                                                        • String ID: }
                                                                                                                                                                                        • API String ID: 675311509-4239843852
                                                                                                                                                                                        • Opcode ID: 4f376d189902667ec821a7058c129ce08e1aa48f831df52116dad5b54edc68b2
                                                                                                                                                                                        • Instruction ID: 8de2c092fd16a0bab510e2275fcff6e0acabf10b8cd9776f3ec25f5824742508
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f376d189902667ec821a7058c129ce08e1aa48f831df52116dad5b54edc68b2
                                                                                                                                                                                        • Instruction Fuzzy Hash: FA3141724047059BCB01EFB8C88498BBBE9FF85358F014D19FE949B151E771EA4A8BD2
                                                                                                                                                                                        Function 6F702BA7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 91COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F702C0E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702C21
                                                                                                                                                                                        • swscanf.MSVCRT ref: 6F702C3B
                                                                                                                                                                                        • memset.MSVCRT ref: 6F702C8C
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,error), ref: 6F702C92
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@swscanf
                                                                                                                                                                                        • String ID: 0A$<Mpo$TimerId:%X$error
                                                                                                                                                                                        • API String ID: 132819863-2343273809
                                                                                                                                                                                        • Opcode ID: 57dc937af9e5f9976e2fadb1cbc088af3a5f389f8cf8dcb93a70148e315f672e
                                                                                                                                                                                        • Instruction ID: 00a11b393ac72262de53940a8f2fa1a03b5ed4366c959051894d6916a283365c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 57dc937af9e5f9976e2fadb1cbc088af3a5f389f8cf8dcb93a70148e315f672e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 762174B26006016BDB15AF2CCE45F6A33F8EF9A724F04407AF915DB394EB60E821D790
                                                                                                                                                                                        Function 6F6F66CA Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 71windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F66E5
                                                                                                                                                                                        • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,?,00000004,?), ref: 6F6F6721
                                                                                                                                                                                        • VerSetConditionMask.KERNEL32(00000000,?,00000001,00000003,?,00000004,?), ref: 6F6F6729
                                                                                                                                                                                        • VerSetConditionMask.KERNEL32(00000000,?,00000020,00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6731
                                                                                                                                                                                        • VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000020,00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6739
                                                                                                                                                                                          • Part of subcall function 6F6F6678: GetModuleHandleW.KERNEL32(ntdll,?,6F6F674B,?,0000002B,00000000,?,?,00000008,00000001,?,00000020,00000003,?,00000001,00000003), ref: 6F6F6680
                                                                                                                                                                                          • Part of subcall function 6F6F6678: GetProcAddress.KERNEL32(00000000,RtlVerifyVersionInfo), ref: 6F6F6690
                                                                                                                                                                                        • GetLastError.KERNEL32(00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6755
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,VerifyVersionInfo() has failed, cannot test Windows version!,StdUtils::verify_os_version,00040010), ref: 6F6F677A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils::verify_os_version, xrefs: 6F6F676F
                                                                                                                                                                                        • VerifyVersionInfo() has failed, cannot test Windows version!, xrefs: 6F6F6774
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ConditionMask$AddressErrorHandleLastMessageModuleProcmemset
                                                                                                                                                                                        • String ID: StdUtils::verify_os_version$VerifyVersionInfo() has failed, cannot test Windows version!
                                                                                                                                                                                        • API String ID: 1050149814-3472982212
                                                                                                                                                                                        • Opcode ID: d74d9d6a7f8ee5ad3063319eec5e01dca723e708861d314d8fe591c911c85feb
                                                                                                                                                                                        • Instruction ID: 9e9b1244ff6cb491a450f9771f1c699defcad11bcfa4fd449448b5a0de219e23
                                                                                                                                                                                        • Opcode Fuzzy Hash: d74d9d6a7f8ee5ad3063319eec5e01dca723e708861d314d8fe591c911c85feb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E1166F1D403287AEB206BA48C46FDB7ABCEF49710F00456AF654F71C1D5755E504BA4
                                                                                                                                                                                        Function 6F7E1260 Relevance: 15.1, APIs: 10, Instructions: 91COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 6F7E1277
                                                                                                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 6F7E1285
                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 6F7E12A4
                                                                                                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 6F7E12B2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Proc$InvalidateRectShow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1966547911-0
                                                                                                                                                                                        • Opcode ID: a604cba22c9b6ac4dc2b37638be8588d3aab5edd6ffa677becbc349740a688bc
                                                                                                                                                                                        • Instruction ID: 993643418aaf69bae29d97a1b9e340b4e689507e13c1f23ca86fbc384053ba02
                                                                                                                                                                                        • Opcode Fuzzy Hash: a604cba22c9b6ac4dc2b37638be8588d3aab5edd6ffa677becbc349740a688bc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 83215E32608218ABD640DB59EC89EEFBBADFBCA771F00047BF655D2540C361A825A771
                                                                                                                                                                                        Function 6F7E1FD0 Relevance: 15.1, APIs: 10, Instructions: 75windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,?), ref: 6F7E1FE9
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,?), ref: 6F7E1FFE
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,?), ref: 6F7E2013
                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,?), ref: 6F7E2027
                                                                                                                                                                                        • GetActiveWindow.USER32 ref: 6F7E202A
                                                                                                                                                                                        • ShowWindow.USER32(?,00000009,?,?,6F7E218F), ref: 6F7E2043
                                                                                                                                                                                        • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6F7E205B
                                                                                                                                                                                        • ShowWindow.USER32(?,00000005,?,?,6F7E218F), ref: 6F7E2070
                                                                                                                                                                                        • DestroyIcon.USER32(?,?,6F7E218F), ref: 6F7E207D
                                                                                                                                                                                        • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6F7E209D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Long$MessageSendShow$ActiveDestroyIcon
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4291089804-0
                                                                                                                                                                                        • Opcode ID: ed61b538766138a1efc201766bf191a62ae448c21fa64cfb5b156e4431617c78
                                                                                                                                                                                        • Instruction ID: d5b27007f58e60d192c778744e9e6a350c3419b94dc1e5375160faebdd3c211b
                                                                                                                                                                                        • Opcode Fuzzy Hash: ed61b538766138a1efc201766bf191a62ae448c21fa64cfb5b156e4431617c78
                                                                                                                                                                                        • Instruction Fuzzy Hash: 44212F79B04615ABEE60DE69DD45F963BACB78A730F100677B510D72C0DB74E420EA60
                                                                                                                                                                                        Function 6F7014E1 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 103COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@_wsetlocalewcsncpy
                                                                                                                                                                                        • String ID: 0A$error
                                                                                                                                                                                        • API String ID: 1215521043-3130266295
                                                                                                                                                                                        • Opcode ID: f3d912a45a072723d39932470642221e3ec4207d1136c4414eff94ae747bafdc
                                                                                                                                                                                        • Instruction ID: 805641fd2820b6e152ebb91135745d11a77860c2be7e0453bdb1983021c0596c
                                                                                                                                                                                        • Opcode Fuzzy Hash: f3d912a45a072723d39932470642221e3ec4207d1136c4414eff94ae747bafdc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 493192F1200A015FDB11AF68CE45F6637F9AFAA328B04407EF906DB3A5EB60D421CB51
                                                                                                                                                                                        Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenW.KERNEL32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                        • lstrlenW.KERNEL32(0040327A,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                        • lstrcatW.KERNEL32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,0040327A,0040327A,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00432227,759223A0), ref: 0040537D
                                                                                                                                                                                        • SetWindowTextW.USER32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe), ref: 0040538F
                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                        • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                        • SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                        • String ID: Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe
                                                                                                                                                                                        • API String ID: 2531174081-3705153479
                                                                                                                                                                                        • Opcode ID: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
                                                                                                                                                                                        • Instruction ID: c4a8b4fbc7344707c8dcd13f789004ac01d88f238d1262f53b2d1dabcf784db2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F21A171900518BBCB11AFA5DD849CFBFB9EF45350F10807AF904B62A0C7B94A80DFA8
                                                                                                                                                                                        Function 6F7E1530 Relevance: 13.6, APIs: 9, Instructions: 65COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E153C
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000001), ref: 6F7E1544
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E155B
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000000), ref: 6F7E1565
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000004), ref: 6F7E157E
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E158B
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000004), ref: 6F7E1599
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 6F7E15A0
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,?,?,75A923D0,?,?,6F7E1AE6), ref: 6F7E15AF
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MetricsSystem$Window
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1155976603-0
                                                                                                                                                                                        • Opcode ID: d11716c589ec596fcaca8f2584625bd5d755431fd36c68d72ad29cf6131125b2
                                                                                                                                                                                        • Instruction ID: 729100abcf99e8760654149cf20c8243881dcaa38ab432cb4aab5b60936fe22c
                                                                                                                                                                                        • Opcode Fuzzy Hash: d11716c589ec596fcaca8f2584625bd5d755431fd36c68d72ad29cf6131125b2
                                                                                                                                                                                        • Instruction Fuzzy Hash: A50156A3B40A196FD640DABCCD4AFEA3A9ADBC5755F0A0133B708C71C4E9A4A8194A50
                                                                                                                                                                                        Function 6F6F5AA8 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 218windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(6F709550,6F70959C), ref: 6F6F5AD4
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(6F709550), ref: 6F6F5D43
                                                                                                                                                                                          • Part of subcall function 6F6F5A5E: RaiseException.KERNEL32(0000046B,00000001,00000000,00000000,6F6F5B0F), ref: 6F6F5A70
                                                                                                                                                                                          • Part of subcall function 6F6F5A5E: LeaveCriticalSection.KERNEL32(?,6F6F5B0F), ref: 6F6F5A78
                                                                                                                                                                                          • Part of subcall function 6F6F6819: GetModuleFileNameW.KERNEL32(6F6F0000,?,00000104,?,?,?), ref: 6F6F6844
                                                                                                                                                                                          • Part of subcall function 6F6F6819: _snwprintf.MSVCRT ref: 6F6F687C
                                                                                                                                                                                          • Part of subcall function 6F6F6819: FatalAppExitW.KERNEL32(00000000,?), ref: 6F6F6892
                                                                                                                                                                                          • Part of subcall function 6F6F6819: GetCurrentProcess.KERNEL32(000000FF), ref: 6F6F6896
                                                                                                                                                                                          • Part of subcall function 6F6F6819: TerminateProcess.KERNEL32(00000000), ref: 6F6F6899
                                                                                                                                                                                          • Part of subcall function 6F6F6819: FatalAppExitW.KERNEL32(00000000,This is not a valid Win32 application!), ref: 6F6F68A2
                                                                                                                                                                                          • Part of subcall function 6F6F6819: GetCurrentProcess.KERNEL32(000000FF), ref: 6F6F68A6
                                                                                                                                                                                          • Part of subcall function 6F6F6819: TerminateProcess.KERNEL32(00000000), ref: 6F6F68A9
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000), ref: 6F6F5B1B
                                                                                                                                                                                          • Part of subcall function 6F6F6619: GetModuleHandleW.KERNEL32(ntdll,?,?,6F6F5B2F), ref: 6F6F6620
                                                                                                                                                                                          • Part of subcall function 6F6F6619: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 6F6F6635
                                                                                                                                                                                          • Part of subcall function 6F6F6619: memset.MSVCRT ref: 6F6F6645
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,GetVersionEx() has failed, cannot detect Windows version!,StdUtils::get_real_os_version,00040010), ref: 6F6F5B4C
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: memset.MSVCRT ref: 6F6F66E5
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,?,00000004,?), ref: 6F6F6721
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,?,00000001,00000003,?,00000004,?), ref: 6F6F6729
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,?,00000020,00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6731
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000020,00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6739
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: GetLastError.KERNEL32(00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6755
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: MessageBoxW.USER32(00000000,VerifyVersionInfo() has failed, cannot test Windows version!,StdUtils::verify_os_version,00040010), ref: 6F6F677A
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 6F6F5B5E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • GetVersionEx() has failed, cannot detect Windows version!, xrefs: 6F6F5B45
                                                                                                                                                                                        • StdUtils::get_real_os_version, xrefs: 6F6F5B40
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ConditionCriticalMaskProcessSection$LeaveModule$CurrentExitFatalHandleMessageTerminatememset$AddressEnterErrorExceptionFileLastNameProcRaise_snwprintf
                                                                                                                                                                                        • String ID: GetVersionEx() has failed, cannot detect Windows version!$StdUtils::get_real_os_version
                                                                                                                                                                                        • API String ID: 391845093-798312201
                                                                                                                                                                                        • Opcode ID: fe31f3e4f05a7660be6d027da9bec2d900159751bf705e16ca8f4343deead438
                                                                                                                                                                                        • Instruction ID: d4213fe7d651f852b20b91d28e4d1b3fb64050e747fb114a5c4892d2f1c07152
                                                                                                                                                                                        • Opcode Fuzzy Hash: fe31f3e4f05a7660be6d027da9bec2d900159751bf705e16ca8f4343deead438
                                                                                                                                                                                        • Instruction Fuzzy Hash: 75915BB460A741DFDB01CF28C880799BBF2BF5A354F00846AF8999B385D731AD16CB56
                                                                                                                                                                                        Function 6F6F5D51 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 157windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(6F709550,6F70959C), ref: 6F6F5D72
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(6F709550), ref: 6F6F5D9D
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: memset.MSVCRT ref: 6F6F66E5
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,?,00000004,?), ref: 6F6F6721
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,?,00000001,00000003,?,00000004,?), ref: 6F6F6729
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,?,00000020,00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6731
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000020,00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6739
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: GetLastError.KERNEL32(00000003,?,00000001,00000003,?,00000004,?), ref: 6F6F6755
                                                                                                                                                                                          • Part of subcall function 6F6F66CA: MessageBoxW.USER32(00000000,VerifyVersionInfo() has failed, cannot test Windows version!,StdUtils::verify_os_version,00040010), ref: 6F6F677A
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F5DBD
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,GetVersionEx() has failed, cannot detect Windows version!,StdUtils::get_real_os_buildNo,00040010), ref: 6F6F5DEF
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 6F6F5E01
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils::get_real_os_buildNo, xrefs: 6F6F5DE3
                                                                                                                                                                                        • GetVersionEx() has failed, cannot detect Windows version!, xrefs: 6F6F5DE8
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ConditionMask$CriticalSection$LeaveMessagememset$EnterErrorLast
                                                                                                                                                                                        • String ID: GetVersionEx() has failed, cannot detect Windows version!$StdUtils::get_real_os_buildNo
                                                                                                                                                                                        • API String ID: 3854406455-1406708275
                                                                                                                                                                                        • Opcode ID: e8d8a595c31cd909be64f7221f3d3efa4609f787039666be542f18e9716ca4ad
                                                                                                                                                                                        • Instruction ID: 1927e9439bcca155bfbaf0504314471e2d012f47f287ff7b1a90537dc9b42271
                                                                                                                                                                                        • Opcode Fuzzy Hash: e8d8a595c31cd909be64f7221f3d3efa4609f787039666be542f18e9716ca4ad
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2051E57050A3519FCB00CE3CDA547857BE26F5B764F108A5AE4A29B3C2DB319D16CB92
                                                                                                                                                                                        Function 6F6FE889 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 157comservicethreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CoCreateInstance.OLE32(6F7041D8,00000000,00000004,6F707424,?,00000001,00000003,?,?,?,?,?,?,?,doo,6F6FEAAC), ref: 6F6FE8AA
                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 6F6FE8C2
                                                                                                                                                                                        • IUnknown_QueryService.SHLWAPI(6F6FEAAC,6F7041C8,6F707434,?,?,?,?,?,?,?,?,doo,6F6FEAAC,?,doo,?), ref: 6F6FE90D
                                                                                                                                                                                        • GetWindowThreadProcessId.USER32(000000FF,00000003), ref: 6F6FE95B
                                                                                                                                                                                        • AllowSetForegroundWindow.USER32(00000003), ref: 6F6FE96D
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 6F6FEA16
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: VariantWindow$AllowClearCreateForegroundInitInstanceProcessQueryServiceThreadUnknown_
                                                                                                                                                                                        • String ID: doo
                                                                                                                                                                                        • API String ID: 3422427859-1071416527
                                                                                                                                                                                        • Opcode ID: 23b227216f107caf0b6b1c50c89aad29b5525cae19ce11f2c4cb9ffcf46ff89b
                                                                                                                                                                                        • Instruction ID: d1e2c0016b1c628d404febd8e029dde5d664d961439bc134d00e28e4bf0b4d03
                                                                                                                                                                                        • Opcode Fuzzy Hash: 23b227216f107caf0b6b1c50c89aad29b5525cae19ce11f2c4cb9ffcf46ff89b
                                                                                                                                                                                        • Instruction Fuzzy Hash: E951F6B4A00219EFDF00DFE5C8489AEBBB9FF99704B10849AF505E7211D7749A42CBA0
                                                                                                                                                                                        Function 6F6F62B2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 123registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F6F5D51: EnterCriticalSection.KERNEL32(6F709550,6F70959C), ref: 6F6F5D72
                                                                                                                                                                                          • Part of subcall function 6F6F5D51: LeaveCriticalSection.KERNEL32(6F709550), ref: 6F6F5D9D
                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020001,?), ref: 6F6F63D6
                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,ReleaseId,00000000,?,?,?), ref: 6F6F6409
                                                                                                                                                                                        • swscanf.MSVCRT ref: 6F6F643C
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 6F6F647F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalSection$CloseEnterLeaveOpenQueryValueswscanf
                                                                                                                                                                                        • String ID: %lu$ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                                                                                                                        • API String ID: 4024238072-3997231445
                                                                                                                                                                                        • Opcode ID: d01162342df657a1ec6f52aae63878ba4ae262b64407d7ce7fe0b90fe81e80ab
                                                                                                                                                                                        • Instruction ID: 6b93ec8c83914075d7fde97af9b70009da7c23b9ac2530914542b44abed860cd
                                                                                                                                                                                        • Opcode Fuzzy Hash: d01162342df657a1ec6f52aae63878ba4ae262b64407d7ce7fe0b90fe81e80ab
                                                                                                                                                                                        • Instruction Fuzzy Hash: 55417DB1049601DBDB10DF14C94498A77FAEFD7328F008A3EE495C6294DB76A55ACF02
                                                                                                                                                                                        Function 6F703475 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 45timewindowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F703232: GetModuleHandleW.KERNEL32(msvcrt,6F703482,?,?,6F702C51), ref: 6F703237
                                                                                                                                                                                          • Part of subcall function 6F703232: GetProcAddress.KERNEL32(00000000,_get_heap_handle), ref: 6F703247
                                                                                                                                                                                          • Part of subcall function 6F703232: HeapValidate.KERNEL32(00000000,00000000,Q,po,?,6F702C51), ref: 6F70325A
                                                                                                                                                                                          • Part of subcall function 6F703232: _msize.MSVCRT ref: 6F703268
                                                                                                                                                                                        • KillTimer.USER32(?,?,00000000,?,6F702C51), ref: 6F70349D
                                                                                                                                                                                        • DestroyWindow.USER32(?,?,6F702C51), ref: 6F7034A8
                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(6F709568), ref: 6F7034BB
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(?,?,6F702C51), ref: 6F7034CD
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Whoops: Double destruction detected and prevented!,StdUtils::TimerDestroy,00040010), ref: 6F7034E7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Whoops: Double destruction detected and prevented!, xrefs: 6F7034E1
                                                                                                                                                                                        • StdUtils::TimerDestroy, xrefs: 6F7034DC
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ??3@AddressDecrementDestroyHandleHeapInterlockedKillMessageModuleProcTimerValidateWindow_msize
                                                                                                                                                                                        • String ID: StdUtils::TimerDestroy$Whoops: Double destruction detected and prevented!
                                                                                                                                                                                        • API String ID: 2361373538-1791884560
                                                                                                                                                                                        • Opcode ID: d18bfcc4f6c809eaf2423c39f1b2420a3742ff3ee2e564662d63f3c8459308b7
                                                                                                                                                                                        • Instruction ID: bc69e977ffc52006cd1d992c1c55690e260ad4012939410e67b3f9dfb2f65443
                                                                                                                                                                                        • Opcode Fuzzy Hash: d18bfcc4f6c809eaf2423c39f1b2420a3742ff3ee2e564662d63f3c8459308b7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8CF028F6101A11AFCEA13EA0FE49DA67BE5BFA6231310843FF255EA140CB326061D615
                                                                                                                                                                                        Function 6F6F6619 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(ntdll,?,?,6F6F5B2F), ref: 6F6F6620
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 6F6F6635
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F6645
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F665E
                                                                                                                                                                                        • GetVersionExW.KERNEL32(?), ref: 6F6F6669
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$AddressHandleModuleProcVersion
                                                                                                                                                                                        • String ID: RtlGetVersion$ntdll
                                                                                                                                                                                        • API String ID: 3959248850-2582309562
                                                                                                                                                                                        • Opcode ID: 844502a8c6d761ea6662ed03e196a589c4c00e104794ba622471fbe600851db7
                                                                                                                                                                                        • Instruction ID: 7ff0ff81fa1b46c495ebe34153e740ad4e970a73e193aed394959c027454e8dd
                                                                                                                                                                                        • Opcode Fuzzy Hash: 844502a8c6d761ea6662ed03e196a589c4c00e104794ba622471fbe600851db7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 84F0ECF169570267E6102F754D4EF9B3AEC9FE7306F10007AF601E1281DF62C516657A
                                                                                                                                                                                        Function 6F703294 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(6F709550), ref: 6F7032A0
                                                                                                                                                                                        • InterlockedExchange.KERNEL32(6F709568,00000000), ref: 6F7032BC
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Whoops: Plug-in unloaded before all timers were destroyed!,StdUtils::TimerCreate,00040010), ref: 6F7032D7
                                                                                                                                                                                        • UnregisterClassW.USER32(?), ref: 6F7032ED
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(6F709550), ref: 6F703303
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Whoops: Plug-in unloaded before all timers were destroyed!, xrefs: 6F7032D0
                                                                                                                                                                                        • StdUtils::TimerCreate, xrefs: 6F7032CB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalSection$ClassEnterExchangeInterlockedLeaveMessageUnregister
                                                                                                                                                                                        • String ID: StdUtils::TimerCreate$Whoops: Plug-in unloaded before all timers were destroyed!
                                                                                                                                                                                        • API String ID: 1654513968-3010961141
                                                                                                                                                                                        • Opcode ID: 7d07e31ce7eb6fe5ecf5a77d7286e211c7a8be7a465c8ec0c6ff8b95becac6da
                                                                                                                                                                                        • Instruction ID: f9911140d8a5d192ee3b6092454d3b8c660e118399d721835166e3df99c6d805
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d07e31ce7eb6fe5ecf5a77d7286e211c7a8be7a465c8ec0c6ff8b95becac6da
                                                                                                                                                                                        • Instruction Fuzzy Hash: A6F068E4110501AADE007F618D09FE537F8BF7B625F40006EF554F62C1EF625511E669
                                                                                                                                                                                        Function 6F703232 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 27librarymemoryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(msvcrt,6F703482,?,?,6F702C51), ref: 6F703237
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,_get_heap_handle), ref: 6F703247
                                                                                                                                                                                        • HeapValidate.KERNEL32(00000000,00000000,Q,po,?,6F702C51), ref: 6F70325A
                                                                                                                                                                                        • _msize.MSVCRT ref: 6F703268
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleHeapModuleProcValidate_msize
                                                                                                                                                                                        • String ID: Q,po$_get_heap_handle$msvcrt
                                                                                                                                                                                        • API String ID: 1777371918-2816099257
                                                                                                                                                                                        • Opcode ID: 70c3530b0a3bcceb6518c1ee5328b5dc57f52bd6ab6d41d0ff5c4147767e99ae
                                                                                                                                                                                        • Instruction ID: fce20ac25e0d1c0e9cf26139bea5081acdf9e8eac0d98c8ebd2f8e2f8cee7235
                                                                                                                                                                                        • Opcode Fuzzy Hash: 70c3530b0a3bcceb6518c1ee5328b5dc57f52bd6ab6d41d0ff5c4147767e99ae
                                                                                                                                                                                        • Instruction Fuzzy Hash: F0E01AB4604601AAEE006FB18E09B5A36D8BFA2A92B5048BAB555E1080CF34C921F925
                                                                                                                                                                                        Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EB), ref: 004042B5
                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 004042F3
                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 004042FF
                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 0040430B
                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040431E
                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 0040432E
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00404348
                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00404352
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                        • Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                                        • Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
                                                                                                                                                                                        • Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                                        • Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54
                                                                                                                                                                                        Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A
                                                                                                                                                                                          • Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7
                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                        • String ID: 9
                                                                                                                                                                                        • API String ID: 163830602-2366072709
                                                                                                                                                                                        • Opcode ID: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
                                                                                                                                                                                        • Instruction ID: 75c70889326ed48cf653b65eedce39ba48716a77e36bbd16e72a3e0392bfe49c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C511975D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB58
                                                                                                                                                                                        Function 6F6FFFE1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 130COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F70004B
                                                                                                                                                                                        • memset.MSVCRT ref: 6F70005D
                                                                                                                                                                                        • memset.MSVCRT ref: 6F700118
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,invalid,00000000,00000000), ref: 6F70011E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@
                                                                                                                                                                                        • String ID: 0A$invalid
                                                                                                                                                                                        • API String ID: 1827009568-1465345006
                                                                                                                                                                                        • Opcode ID: c8a4f00bd5b97e29c64699c50f9a8cf85567a69a7777e67628e72f0ea885cedc
                                                                                                                                                                                        • Instruction ID: 8be6de87618d5e38366596e84d1210322d6d7897e37a370226e901fe79103fa2
                                                                                                                                                                                        • Opcode Fuzzy Hash: c8a4f00bd5b97e29c64699c50f9a8cf85567a69a7777e67628e72f0ea885cedc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4131DFF23446054BDB14AF2CDE85AAB33E9EF95374B00913BE815DB398EA31E8518794
                                                                                                                                                                                        Function 6F6F6EC2 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 69windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Inconsistent state detected, going to abort!,StdUtils::HashFunction_Update,00040010), ref: 6F6F6F67
                                                                                                                                                                                        • abort.MSVCRT(?,6F701E86,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6F6F6F6D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils::HashFunction_Update, xrefs: 6F6F6F4A
                                                                                                                                                                                        • Blake2_Update internal error, going to abort!, xrefs: 6F6F6F4F
                                                                                                                                                                                        • Inconsistent state detected, going to abort!, xrefs: 6F6F6F60
                                                                                                                                                                                        • StdUtils::HashFunction_Update, xrefs: 6F6F6F5B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Messageabort
                                                                                                                                                                                        • String ID: Blake2_Update internal error, going to abort!$Inconsistent state detected, going to abort!$StdUtils::HashFunction_Update$StdUtils::HashFunction_Update
                                                                                                                                                                                        • API String ID: 372540446-3600407960
                                                                                                                                                                                        • Opcode ID: 58a9ac44073fa7bf3e94e571075453d9d620fb5bcd455defd6f9a2169a157500
                                                                                                                                                                                        • Instruction ID: ee76c961ef61e78cf9fa53933e71088e78bfa883126b1ce60c5340993ecbd88f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 58a9ac44073fa7bf3e94e571075453d9d620fb5bcd455defd6f9a2169a157500
                                                                                                                                                                                        • Instruction Fuzzy Hash: 561173F241A714ABDB14AB78BD04EAB33FFAF45711B14492FF25392880DB33E5155628
                                                                                                                                                                                        Function 6F6F6FA1 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Blake2_Final internal error, going to abort!,StdUtils::HashFunction_Final,00040010), ref: 6F6F702A
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Inconsistent state detected, going to abort!,StdUtils::HashFunction_Final,00040010), ref: 6F6F7048
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils::HashFunction_Final, xrefs: 6F6F701E
                                                                                                                                                                                        • Inconsistent state detected, going to abort!, xrefs: 6F6F7041
                                                                                                                                                                                        • StdUtils::HashFunction_Final, xrefs: 6F6F703C
                                                                                                                                                                                        • Blake2_Final internal error, going to abort!, xrefs: 6F6F7023
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message
                                                                                                                                                                                        • String ID: Blake2_Final internal error, going to abort!$Inconsistent state detected, going to abort!$StdUtils::HashFunction_Final$StdUtils::HashFunction_Final
                                                                                                                                                                                        • API String ID: 2030045667-160346839
                                                                                                                                                                                        • Opcode ID: ff1cdf46fd118576ccae701111b750e73e6900bb45a196c373640c691d51bdfe
                                                                                                                                                                                        • Instruction ID: acb8f993bfb200f6f9f59d8f0ae6941c8e2b67ddc7533a258249b950389ed118
                                                                                                                                                                                        • Opcode Fuzzy Hash: ff1cdf46fd118576ccae701111b750e73e6900bb45a196c373640c691d51bdfe
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2801C4F210F220DBD7106B2CBC55FDA37E7AF5B729B01002AE545A6580CF626D035769
                                                                                                                                                                                        Function 6F6F7336 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56libraryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F734A
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(shell32), ref: 6F6F735C
                                                                                                                                                                                        • LoadLibraryW.KERNEL32(shell32), ref: 6F6F736E
                                                                                                                                                                                        • LoadStringW.USER32(?,?,?,?), ref: 6F6F7396
                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 6F6F73B8
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: LibraryLoad$FreeHandleModuleStringmemset
                                                                                                                                                                                        • String ID: shell32
                                                                                                                                                                                        • API String ID: 444683323-4179111565
                                                                                                                                                                                        • Opcode ID: 86d6dc36a46217654e81da77d41cae5bd1fe9d0475be51b4c6fbe50bbb150017
                                                                                                                                                                                        • Instruction ID: f1e167bc8f46e1e53ddff640d5bd1ad7f6eec22b577648e1bf8770e44552e427
                                                                                                                                                                                        • Opcode Fuzzy Hash: 86d6dc36a46217654e81da77d41cae5bd1fe9d0475be51b4c6fbe50bbb150017
                                                                                                                                                                                        • Instruction Fuzzy Hash: A311E072509245BFEF028FA8CC45BCDBFBABF46324F0041E5EC14A6290E7719956DB21
                                                                                                                                                                                        Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
                                                                                                                                                                                        • GetMessagePos.USER32 ref: 00404C0F
                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00404C29
                                                                                                                                                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
                                                                                                                                                                                        • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                        • Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                                        • Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
                                                                                                                                                                                        • Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                                        • Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4
                                                                                                                                                                                        Function 6F6F678B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F67A6
                                                                                                                                                                                        • VerSetConditionMask.KERNEL32(00000000,00000000,00000004,00000003,?,7FFFFFFF,?), ref: 6F6F67C3
                                                                                                                                                                                          • Part of subcall function 6F6F6678: GetModuleHandleW.KERNEL32(ntdll,?,6F6F674B,?,0000002B,00000000,?,?,00000008,00000001,?,00000020,00000003,?,00000001,00000003), ref: 6F6F6680
                                                                                                                                                                                          • Part of subcall function 6F6F6678: GetProcAddress.KERNEL32(00000000,RtlVerifyVersionInfo), ref: 6F6F6690
                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,7FFFFFFF,?), ref: 6F6F67E3
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,VerifyVersionInfo() has failed, cannot test Windows version!,StdUtils::verify_os_buildNo,00040010), ref: 6F6F6808
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils::verify_os_buildNo, xrefs: 6F6F67FD
                                                                                                                                                                                        • VerifyVersionInfo() has failed, cannot test Windows version!, xrefs: 6F6F6802
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressConditionErrorHandleLastMaskMessageModuleProcmemset
                                                                                                                                                                                        • String ID: StdUtils::verify_os_buildNo$VerifyVersionInfo() has failed, cannot test Windows version!
                                                                                                                                                                                        • API String ID: 1975654473-1721658860
                                                                                                                                                                                        • Opcode ID: 94eae86bf65965b15edd250fa49a51f300d44d18ff760e3414941565b3a02b62
                                                                                                                                                                                        • Instruction ID: 325a2decdf5308c5a94a485c530cb756b12a95564c313eaebc38855ab7f1d66a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 94eae86bf65965b15edd250fa49a51f300d44d18ff760e3414941565b3a02b62
                                                                                                                                                                                        • Instruction Fuzzy Hash: 010126F18012283BEB102BA48C8AFDB36BCAF0A708F0009BBF245F6181D5718E6046B5
                                                                                                                                                                                        Function 6F7E1350 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateWindowExW.USER32(00000000,static,00000000,40000000,00000000,00000000,00000002,00000002,?,00000000,?,00000000), ref: 6F7E1375
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000040,?,?,6F7E1C05,?,?), ref: 6F7E138E
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000020,?,?,6F7E1C05,?,?), ref: 6F7E1399
                                                                                                                                                                                        • SetWindowLongW.USER32(00000000,000000FC,6F7E1260), ref: 6F7E13A8
                                                                                                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000023,?,?,6F7E1C05,?,?), ref: 6F7E13BB
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973206308.000000006F7E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6F7E0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973178680.000000006F7E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973258535.000000006F7E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973298080.000000006F7E5000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f7e0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$AllocGlobal$CreateLong
                                                                                                                                                                                        • String ID: static
                                                                                                                                                                                        • API String ID: 1198755920-2160076837
                                                                                                                                                                                        • Opcode ID: 332fad448d2eeea910c1a1ac722627fd524ff1763eb1218357b785f8d32e6207
                                                                                                                                                                                        • Instruction ID: d309e8ecfd4d50d94829890e5be6ecd11e8cbc7803bc5d2b3f908b8cb572e0b2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 332fad448d2eeea910c1a1ac722627fd524ff1763eb1218357b785f8d32e6207
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1FF0307178471076F6705B55AC0BFDA7A559BC5F31F210167F704BE1D0C6F4AD008698
                                                                                                                                                                                        Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401DBC
                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00401DEF
                                                                                                                                                                                        • CreateFontIndirectW.GDI32(0041E5D0), ref: 00401E3E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                                        • String ID: MS Shell Dlg
                                                                                                                                                                                        • API String ID: 3808545654-76309092
                                                                                                                                                                                        • Opcode ID: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
                                                                                                                                                                                        • Instruction ID: 2f87ef527a079fcd98b3174ff93e15f92fad6858fb92d4176ae60913c966d855
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A01B575604240BFE700ABF1AE0ABDD7FB5AB55309F10887DF641B61E2DA7840458B2D
                                                                                                                                                                                        Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
                                                                                                                                                                                        • MulDiv.KERNEL32(03B8B360,00000064,03B8FD18), ref: 00402E3C
                                                                                                                                                                                        • wsprintfW.USER32 ref: 00402E4C
                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 00402E5C
                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • verifying installer: %d%%, xrefs: 00402E46
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                        • String ID: verifying installer: %d%%
                                                                                                                                                                                        • API String ID: 1451636040-82062127
                                                                                                                                                                                        • Opcode ID: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
                                                                                                                                                                                        • Instruction ID: dfd142ddc65d39fdaa73b229a9921dc7c235b7e072e3123d651e00bd55f03bcf
                                                                                                                                                                                        • Opcode Fuzzy Hash: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 60014F7164020CABEF209F60DE49FAE3B69AB44304F008439FA06B51E0DBB895558B98
                                                                                                                                                                                        Function 6F902569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6F90121B: GlobalAlloc.KERNEL32(00000040,?,6F90123B,?,6F9012DF,00000019,6F9011BE,-000000A0), ref: 6F901225
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 6F902657
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F90268C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$Free$Alloc
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1780285237-0
                                                                                                                                                                                        • Opcode ID: 01d0512a626a5cec3c5bc65be3ce782d20a8c88c91c980fb97af961cf8193e5e
                                                                                                                                                                                        • Instruction ID: 7f0809f96356864799046e93470f5649f5534102a06d41589e526358f5661585
                                                                                                                                                                                        • Opcode Fuzzy Hash: 01d0512a626a5cec3c5bc65be3ce782d20a8c88c91c980fb97af961cf8193e5e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9131CB31908501DFEB24AF68C894C2A7BBAFF97314710426EF645932A0C731E8A5CF69
                                                                                                                                                                                        Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00402956
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00402969
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2667972263-0
                                                                                                                                                                                        • Opcode ID: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
                                                                                                                                                                                        • Instruction ID: 85d8fb478e53a7d33050a02afe9876517184a336e4e72b82bbd0c3cba42884f9
                                                                                                                                                                                        • Opcode Fuzzy Hash: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
                                                                                                                                                                                        • Instruction Fuzzy Hash: D121AEB1800128BBDF116FA5DE89DDE7E79EF08364F14423AF960762E0CB794C418B98
                                                                                                                                                                                        Function 6F70339B Relevance: 9.1, APIs: 6, Instructions: 78timeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000001,00000001,000000FD,00000000,00000000,00000000), ref: 6F7033EE
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000018,?,?,?,6F702B75,00000000,00000000,?,?,?), ref: 6F7033FD
                                                                                                                                                                                        • SetTimer.USER32(00000000,00000000,000005DC), ref: 6F703441
                                                                                                                                                                                        • DestroyWindow.USER32(00000000,?,6F702B75,00000000,00000000,?,?,?), ref: 6F70344D
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,?,6F702B75,00000000,00000000,?,?,?), ref: 6F703454
                                                                                                                                                                                          • Part of subcall function 6F70330C: EnterCriticalSection.KERNEL32(6F709550,00000000,6F7033C9,00000000,?,?,6F702B75,00000000,00000000,?,?,?), ref: 6F703319
                                                                                                                                                                                          • Part of subcall function 6F70330C: RegisterClassW.USER32(?), ref: 6F703353
                                                                                                                                                                                          • Part of subcall function 6F70330C: LeaveCriticalSection.KERNEL32(6F709550,?,?,6F702B75,00000000,00000000,?,?,?), ref: 6F70337E
                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(6F709568), ref: 6F70346B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalSectionWindow$??2@??3@ClassCreateDestroyEnterIncrementInterlockedLeaveRegisterTimer
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 510415137-0
                                                                                                                                                                                        • Opcode ID: 755ba0d83adec962371959db05ef1951d1fa790cff1465c359d1abb8dab931b6
                                                                                                                                                                                        • Instruction ID: 72cd176489635509622ab0c6a1dc5a9b1868d546bd6953c8ef96adafdcb0e512
                                                                                                                                                                                        • Opcode Fuzzy Hash: 755ba0d83adec962371959db05ef1951d1fa790cff1465c359d1abb8dab931b6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C219DB1501625AFCB51AF65D949DAA7FE8FF5A760B00402EF918DB280CB319451CBA1
                                                                                                                                                                                        Function 1000103F Relevance: 9.1, APIs: 6, Instructions: 55synchronizationCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • OpenProcess.KERNEL32(00100401,00000000,?,0000025E,?,00004000,?), ref: 10001054
                                                                                                                                                                                        • EnumWindows.USER32(10001007,?), ref: 10001074
                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32(00000000,?), ref: 10001084
                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 1000109D
                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000,00000000), ref: 100010AE
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 100010C5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972788397.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972745176.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972838462.0000000010002000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972865160.0000000010004000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_10000000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Process$CloseCodeEnumExitHandleObjectOpenSingleTerminateWaitWindows
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3465249596-0
                                                                                                                                                                                        • Opcode ID: ba2bc8da3a6140de48577a9aba2e14b09a295dc7b85f115a3014824a2a14e04b
                                                                                                                                                                                        • Instruction ID: a75cb7c18b994dd6f526631e0a7af626cc5939ab073c97fe0f3ca5b5d0fb8a21
                                                                                                                                                                                        • Opcode Fuzzy Hash: ba2bc8da3a6140de48577a9aba2e14b09a295dc7b85f115a3014824a2a14e04b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3811E235A00299EFFB00DFA5CDC8AEE77BCEB456C5F014069FA4192149D7B49981CB62
                                                                                                                                                                                        Function 6F6FFC4A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FFCB1
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFCC4
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFD34
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000), ref: 6F6FFD3A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1827009568-2007828011
                                                                                                                                                                                        • Opcode ID: dcd900c7aa6b26ab6780cb18a6d2145dec76c1fca3c4a6c2b185c8d1ca923beb
                                                                                                                                                                                        • Instruction ID: 1e5cebf32074a5ce6a3902f5ddf9af640483459b9dea2aaf81073ca584cc79e5
                                                                                                                                                                                        • Opcode Fuzzy Hash: dcd900c7aa6b26ab6780cb18a6d2145dec76c1fca3c4a6c2b185c8d1ca923beb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 99219171701A125BD7259F28DD06B6B76F9EF8A320B04452DF946CB3A8EB60E562C780
                                                                                                                                                                                        Function 6F6FF9D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FFA3E
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFA51
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFA9A
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000), ref: 6F6FFAA0
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1827009568-2007828011
                                                                                                                                                                                        • Opcode ID: 75b2680cb9891df7480151a6e86eb8fd827018b28fd5650a99df7febe4a2a9d3
                                                                                                                                                                                        • Instruction ID: ea1834532d87c56525adb4e920d9ac5b190bf743116ccf60780d9320e3caf719
                                                                                                                                                                                        • Opcode Fuzzy Hash: 75b2680cb9891df7480151a6e86eb8fd827018b28fd5650a99df7febe4a2a9d3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 15219FB17016029FE754AB38CD06F2A32F9AF9A624F04453EF915CB3D4EB20D821C750
                                                                                                                                                                                        Function 6F6FFB7B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FFBE2
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFBF5
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFC39
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000), ref: 6F6FFC3F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1827009568-2007828011
                                                                                                                                                                                        • Opcode ID: dfbed6a23624084d4ac63545c8073ef01b55b43fc32e72f7587f5331bac84737
                                                                                                                                                                                        • Instruction ID: 89b561a3dfa2762080cf50dd1257df151d354844dd8594817c13a032b7812dca
                                                                                                                                                                                        • Opcode Fuzzy Hash: dfbed6a23624084d4ac63545c8073ef01b55b43fc32e72f7587f5331bac84737
                                                                                                                                                                                        • Instruction Fuzzy Hash: B2218EB1702A125BE715AB28CD06F5B36F9AF9A224F00453AF905DB3D4EB60D822C785
                                                                                                                                                                                        Function 6F6FFAAC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 6F6FFB14
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFB27
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FFB69
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00002000,00000000,00000000,00000000), ref: 6F6FFB6F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memset$??2@??3@
                                                                                                                                                                                        • String ID: 0A
                                                                                                                                                                                        • API String ID: 1827009568-2007828011
                                                                                                                                                                                        • Opcode ID: 04252febaebbbbc87060072a16728211bdfcffe239d93872cea763e5f69cbb0e
                                                                                                                                                                                        • Instruction ID: bc3ebbc545544a6f4a9b441a905049ba8bc146c6b396d6f6b1ca4b1e43438b86
                                                                                                                                                                                        • Opcode Fuzzy Hash: 04252febaebbbbc87060072a16728211bdfcffe239d93872cea763e5f69cbb0e
                                                                                                                                                                                        • Instruction Fuzzy Hash: CC21CDB1701A029FE714AB2CCD46F2A32F9AF9A624F04413EF515CB3D4EB20D821C780
                                                                                                                                                                                        Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,75923420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
                                                                                                                                                                                        • CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
                                                                                                                                                                                        • CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,75923420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
                                                                                                                                                                                        • CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,75923420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                        • String ID: *?|<>/":
                                                                                                                                                                                        • API String ID: 589700163-165019052
                                                                                                                                                                                        • Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
                                                                                                                                                                                        • Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
                                                                                                                                                                                        • Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
                                                                                                                                                                                        • Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD
                                                                                                                                                                                        Function 6F6FEA22 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62synchronizationthreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _beginthreadex.MSVCRT ref: 6F6FEA5B
                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000000,00007530,?,?,?,?,?,?,?,?,?,?,?,76334C50), ref: 6F6FEA75
                                                                                                                                                                                        • TerminateThread.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,76334C50), ref: 6F6FEA92
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,76334C50), ref: 6F6FEA99
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandleObjectSingleTerminateThreadWait_beginthreadex
                                                                                                                                                                                        • String ID: doo
                                                                                                                                                                                        • API String ID: 1973763741-1071416527
                                                                                                                                                                                        • Opcode ID: 6e8c0429db158b46ea45cd9c55a95cd4dd327b3b6ca5ea7158bbdf8ae27de170
                                                                                                                                                                                        • Instruction ID: 2239935c1a98a40a1c446a0f2c5b206e00c21f2724b0c15f90d229a1548ea4fb
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6e8c0429db158b46ea45cd9c55a95cd4dd327b3b6ca5ea7158bbdf8ae27de170
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D110672509204AFD7109E689C8499F3FAAFB91331F00427AF979D71C0DB31A95247A5
                                                                                                                                                                                        Function 6F6FEE56 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 53windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,RandMinMax() was called with bad arguments!,StdUtils,00002010), ref: 6F6FEED9
                                                                                                                                                                                          • Part of subcall function 6F7037EB: wsprintfW.USER32 ref: 6F703803
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Messagewsprintf
                                                                                                                                                                                        • String ID: 0A$RandMinMax() was called with bad arguments!$StdUtils$einval
                                                                                                                                                                                        • API String ID: 300413163-1866428257
                                                                                                                                                                                        • Opcode ID: 639c2771b9fe7305bf4d4b1cf7893de0935e86ba02cee4f159c6215dc83a3185
                                                                                                                                                                                        • Instruction ID: 1515da0f35ed4b153221298d0d8c5cd3c191b8fa2ec37771e407eaf5416f4172
                                                                                                                                                                                        • Opcode Fuzzy Hash: 639c2771b9fe7305bf4d4b1cf7893de0935e86ba02cee4f159c6215dc83a3185
                                                                                                                                                                                        • Instruction Fuzzy Hash: AC118EB0645B025BD711EF28E944E067BF6AFAA224B00052EF516D7284CB70D852C781
                                                                                                                                                                                        Function 6F6FEDB7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 50windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,RandMax() was called with bad arguments!,StdUtils,00002010), ref: 6F6FEE33
                                                                                                                                                                                          • Part of subcall function 6F7037EB: wsprintfW.USER32 ref: 6F703803
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Messagewsprintf
                                                                                                                                                                                        • String ID: 0A$RandMax() was called with bad arguments!$StdUtils$einval
                                                                                                                                                                                        • API String ID: 300413163-2275736246
                                                                                                                                                                                        • Opcode ID: 7a1b780e4b48414bbdcefd27f378b95853a0ef5a47cac2a66f75b8b719d82b31
                                                                                                                                                                                        • Instruction ID: d728a49aacd7c7832f9c69e98802ea0176b70f75eefd253c6bfa6ab3516f42d6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a1b780e4b48414bbdcefd27f378b95853a0ef5a47cac2a66f75b8b719d82b31
                                                                                                                                                                                        • Instruction Fuzzy Hash: 800169B02057026BEB15AF29D905B06BBF6AFAA324F00012EF615D72D4DF709852CB81
                                                                                                                                                                                        Function 6F6F6678 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(ntdll,?,6F6F674B,?,0000002B,00000000,?,?,00000008,00000001,?,00000020,00000003,?,00000001,00000003), ref: 6F6F6680
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,RtlVerifyVersionInfo), ref: 6F6F6690
                                                                                                                                                                                        • VerifyVersionInfoW.KERNEL32(00000001,?,00000003,00000020), ref: 6F6F66BC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleInfoModuleProcVerifyVersion
                                                                                                                                                                                        • String ID: RtlVerifyVersionInfo$ntdll
                                                                                                                                                                                        • API String ID: 2421535698-1699696460
                                                                                                                                                                                        • Opcode ID: d8151dba9bf55ee8712cbb30cc07089a11deaa1b2c88f044373313cb0fee398b
                                                                                                                                                                                        • Instruction ID: 80eacae8271c0ef393a8fd75651576b32262b2a4ee738dd005a90d7657b62d65
                                                                                                                                                                                        • Opcode Fuzzy Hash: d8151dba9bf55ee8712cbb30cc07089a11deaa1b2c88f044373313cb0fee398b
                                                                                                                                                                                        • Instruction Fuzzy Hash: C6F0307110410AFBDF015FA0DD0499A3F6ABF4A2507004025FA18D4020DB33D631BFA5
                                                                                                                                                                                        Function 6F9018D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FreeGlobal
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2979337801-0
                                                                                                                                                                                        • Opcode ID: 958f312bd61b1aca90c79ddac4a7ce23450c1a1dfddf8aed0643dfcce06a181a
                                                                                                                                                                                        • Instruction ID: 5d16e8edc12ef5f4da92acf8aba104c365e895592de790216ef16926a7425c16
                                                                                                                                                                                        • Opcode Fuzzy Hash: 958f312bd61b1aca90c79ddac4a7ce23450c1a1dfddf8aed0643dfcce06a181a
                                                                                                                                                                                        • Instruction Fuzzy Hash: A0519332D041599A8B91BFB889805AEB6BAEF4735CB40427FD514A72C1D770FEC187A1
                                                                                                                                                                                        Function 6F6F7664 Relevance: 7.6, APIs: 5, Instructions: 133COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AttributesFileVersioncallocfreememset
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 233172667-0
                                                                                                                                                                                        • Opcode ID: 6473cf39869352d18c385437ddaa0c0438b7119a56d4fec1cc4b9aaa167be765
                                                                                                                                                                                        • Instruction ID: 2e05c4a898bdeff2f147ac87ded2522d91e0283fa500eedfc3c3ae90f0c24021
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6473cf39869352d18c385437ddaa0c0438b7119a56d4fec1cc4b9aaa167be765
                                                                                                                                                                                        • Instruction Fuzzy Hash: C041C5769052099BCF14DFA8C8557CFB7F6EF89314F0480A5ED06EB280E770AA51CB94
                                                                                                                                                                                        Function 6F6F794C Relevance: 7.6, APIs: 5, Instructions: 102COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _wcsicmp_wcsnicmpiswgraphwcschrwcsncpy
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3078426274-0
                                                                                                                                                                                        • Opcode ID: c11d192e6586cd181740b9a28e1b1ce490cf15563f0ebac6df1291b0050a5661
                                                                                                                                                                                        • Instruction ID: a55202575a8045c7ce697f1227503afd84f84ec7b53a554b48221cc1c80f7c76
                                                                                                                                                                                        • Opcode Fuzzy Hash: c11d192e6586cd181740b9a28e1b1ce490cf15563f0ebac6df1291b0050a5661
                                                                                                                                                                                        • Instruction Fuzzy Hash: 993126315066029BDF105FA4D8968EA33B7FF4A320712852FE991CB150EB31A793C7D1
                                                                                                                                                                                        Function 6F6F785A Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(6F709550,00000000,00000000,00000000,00000000), ref: 6F6F7867
                                                                                                                                                                                        • __wgetmainargs.MSVCRT ref: 6F6F7893
                                                                                                                                                                                        • GetVersion.KERNEL32 ref: 6F6F78A0
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(6F709550), ref: 6F6F78E4
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(6F709550), ref: 6F6F78F7
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalSection$Leave$EnterVersion__wgetmainargs
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 749008033-0
                                                                                                                                                                                        • Opcode ID: cd0684e8dcb15ff21b81f5a75acdc53382548fa2c6335e74c042bf4cf52f65a3
                                                                                                                                                                                        • Instruction ID: 7f671ced38c36a7686762dd8fd242f48285fb5d57361384fcd0945d569c7b308
                                                                                                                                                                                        • Opcode Fuzzy Hash: cd0684e8dcb15ff21b81f5a75acdc53382548fa2c6335e74c042bf4cf52f65a3
                                                                                                                                                                                        • Instruction Fuzzy Hash: CD014EB04155046ADF006FB488087FE7FB9AFA7315F0000BAE862B22C2CF644207E776
                                                                                                                                                                                        Function 6F90161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6F9021EC,?,00000808), ref: 6F901635
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6F9021EC,?,00000808), ref: 6F90163C
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6F9021EC,?,00000808), ref: 6F901650
                                                                                                                                                                                        • GetProcAddress.KERNEL32(6F9021EC,00000000), ref: 6F901657
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F901660
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1148316912-0
                                                                                                                                                                                        • Opcode ID: 27e32c8cb4257ad92ed38480a76eef9f6b16515be03601350aa6b497b76f8e87
                                                                                                                                                                                        • Instruction ID: d7efbbb243d2b21fc7248a2965adda25a63f633cdab4ad4e9025da35cea4ba4a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 27e32c8cb4257ad92ed38480a76eef9f6b16515be03601350aa6b497b76f8e87
                                                                                                                                                                                        • Instruction Fuzzy Hash: 59F0A27210A5387BEA2116AA8C4CC9B7EACEF9B2F5B110219F718A11A0C5615D11DFF5
                                                                                                                                                                                        Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00401D63
                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401D70
                                                                                                                                                                                        • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401DAE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                        • Opcode ID: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
                                                                                                                                                                                        • Instruction ID: d9fd13ec482603559a9c09f77eb5ae76b99fbdc016b4c624d38ebcad95bf5f4c
                                                                                                                                                                                        • Opcode Fuzzy Hash: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 28F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F61A0CA749D519B78
                                                                                                                                                                                        Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
                                                                                                                                                                                        • wsprintfW.USER32 ref: 00404B88
                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                        • String ID: %u.%u%s%s
                                                                                                                                                                                        • API String ID: 3540041739-3551169577
                                                                                                                                                                                        • Opcode ID: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
                                                                                                                                                                                        • Instruction ID: 65d6ef813479b3ccfd969ec0db039784a4d8c6b5967a53089d3579ec78c560c8
                                                                                                                                                                                        • Opcode Fuzzy Hash: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
                                                                                                                                                                                        • Instruction Fuzzy Hash: 401193736041282ADB00656D9C45F9E369C9B85334F25423BFA65F21D1E979D82582E8
                                                                                                                                                                                        Function 00402598 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,000000FF,0040E5D0,00002000,?,?,00000021), ref: 004025E8
                                                                                                                                                                                        • lstrlenA.KERNEL32(0040E5D0,?,?,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,000000FF,0040E5D0,00002000,?,?,00000021), ref: 004025F3
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe, xrefs: 004025E1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                                        • String ID: Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe
                                                                                                                                                                                        • API String ID: 3109718747-3705153479
                                                                                                                                                                                        • Opcode ID: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
                                                                                                                                                                                        • Instruction ID: b23dc685b5da5394ac89c8ab13f2cbf985e24fd8d9932a4f5164fd221fdd45c5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 76110B72A04201BADB146FF18E89A9F76659F44398F204C3FF102F61D1EAFC89415B5D
                                                                                                                                                                                        Function 6F701C04 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _wcsicmp.MSVCRT ref: 6F701D66
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,And invalid hash function has been specified!,StdUtils,00002010), ref: 6F701D96
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils, xrefs: 6F701D8B
                                                                                                                                                                                        • And invalid hash function has been specified!, xrefs: 6F701D90
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message_wcsicmp
                                                                                                                                                                                        • String ID: And invalid hash function has been specified!$StdUtils
                                                                                                                                                                                        • API String ID: 269843332-1797804575
                                                                                                                                                                                        • Opcode ID: 6f0d9b5668a3e14738e6364c48d0f5567805795cbd88d3bc6fecf8cb17f53276
                                                                                                                                                                                        • Instruction ID: 187e0cfd5036af6c59b1cd0cc7877c54f10a5e0f559b1353d39d52804620dc79
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f0d9b5668a3e14738e6364c48d0f5567805795cbd88d3bc6fecf8cb17f53276
                                                                                                                                                                                        • Instruction Fuzzy Hash: FF315AF0005A419EDB14AF56D6857423AB5BFF2329F10423FE1608A3D8DFB65064EF58
                                                                                                                                                                                        Function 6F6F724B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Output buffer is too small to hold the hash value!,StdUtils::HashUtils,00040010), ref: 6F6F72F6
                                                                                                                                                                                          • Part of subcall function 6F6F6CBA: memset.MSVCRT ref: 6F6F6CCA
                                                                                                                                                                                          • Part of subcall function 6F7034F1: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,?,?,?,6F7001BF,00000000,00000000), ref: 6F70350F
                                                                                                                                                                                          • Part of subcall function 6F7034F1: ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,?,?,?,6F7001BF,00000000,00000000,00000000), ref: 6F703518
                                                                                                                                                                                          • Part of subcall function 6F7034F1: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,?,6F7001BF,00000000,00000000,00000000), ref: 6F70352F
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00000000), ref: 6F6F72B8
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Output buffer is too small to hold the hash value!, xrefs: 6F6F72EF
                                                                                                                                                                                        • StdUtils::HashUtils, xrefs: 6F6F72EA
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWide$??2@??3@Messagememset
                                                                                                                                                                                        • String ID: Output buffer is too small to hold the hash value!$StdUtils::HashUtils
                                                                                                                                                                                        • API String ID: 917187386-2810855571
                                                                                                                                                                                        • Opcode ID: d4161f0209387b67ce625c085fec5e0d72c67ef73d0761686d0121ce13b3eb1d
                                                                                                                                                                                        • Instruction ID: d7a25a4219945a0f8e70d1b31226e5fbf798111fade0eab52c635640198ec1e2
                                                                                                                                                                                        • Opcode Fuzzy Hash: d4161f0209387b67ce625c085fec5e0d72c67ef73d0761686d0121ce13b3eb1d
                                                                                                                                                                                        • Instruction Fuzzy Hash: C9110A723097045BCB11AA2CAD44BDA37A79FC6324F10022AFC55E72D0DF31A95B8695
                                                                                                                                                                                        Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenW.KERNEL32(Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000023,00000011,00000002), ref: 0040242F
                                                                                                                                                                                        • RegSetValueExW.ADVAPI32(?,?,?,?,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00000011,00000002), ref: 0040246F
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseValuelstrlen
                                                                                                                                                                                        • String ID: Copy to C:\Users\user\AppData\Local\neatreader-updater\installer.exe
                                                                                                                                                                                        • API String ID: 2655323295-3705153479
                                                                                                                                                                                        • Opcode ID: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
                                                                                                                                                                                        • Instruction ID: a703f9f7a84a81219e2528cb215680d2185ac4e531b753f9c0eacf199e84c27d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
                                                                                                                                                                                        • Instruction Fuzzy Hash: AF118471D00104BEEB10AFA5DE89EAEBA74AB44754F11803BF504F71D1D7F48D409B29
                                                                                                                                                                                        Function 6F702B04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _snwprintf
                                                                                                                                                                                        • String ID: 0A$TimerId:%08X$error
                                                                                                                                                                                        • API String ID: 3988819677-3919555845
                                                                                                                                                                                        • Opcode ID: dbd0bb145d75daa6ffb3da3700f1a39cbf11ddf0d055fafea27e34925af50127
                                                                                                                                                                                        • Instruction ID: 6a383a719caa431a13053c6d8ccfa7eb1ef32db25fb651972bbf2bbc37fb73ea
                                                                                                                                                                                        • Opcode Fuzzy Hash: dbd0bb145d75daa6ffb3da3700f1a39cbf11ddf0d055fafea27e34925af50127
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F1151F1A00616ABDB01EF69CE45E8A7BF8AF59264B00413AF915D7380EB30E411C7A1
                                                                                                                                                                                        Function 6F6F129F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000003,00000000,?,6F70036D,00000000,00000000,00000000), ref: 6F6F12D1
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6F12F0
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,00000000,00000003,6F70036D,00000000,00000000,00000000), ref: 6F6F12F6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 6F6F12AC
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ??2@??3@memset
                                                                                                                                                                                        • String ID: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
                                                                                                                                                                                        • API String ID: 808632339-1856702088
                                                                                                                                                                                        • Opcode ID: 8e1eeca393cac4fa2e75919d6350c4df544e7f0e9f941b33be440b20327d2e69
                                                                                                                                                                                        • Instruction ID: 9ab5b830c7daf1a5da870ce809ceea58bdf9316d7680640282781eda8c982e82
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e1eeca393cac4fa2e75919d6350c4df544e7f0e9f941b33be440b20327d2e69
                                                                                                                                                                                        • Instruction Fuzzy Hash: 48F0C2B11092016FD3109F78DAC5E2B77E9FFC1766F20086DF481C2181DB21D456A626
                                                                                                                                                                                        Function 6F6F6BEF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,Inconsistent state detected, going to abort!,StdUtils::Blake2_Size,00040010), ref: 6F6F6C0E
                                                                                                                                                                                        • abort.MSVCRT ref: 6F6F6C14
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Inconsistent state detected, going to abort!, xrefs: 6F6F6C07
                                                                                                                                                                                        • StdUtils::Blake2_Size, xrefs: 6F6F6C02
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Messageabort
                                                                                                                                                                                        • String ID: Inconsistent state detected, going to abort!$StdUtils::Blake2_Size
                                                                                                                                                                                        • API String ID: 372540446-3734068583
                                                                                                                                                                                        • Opcode ID: 1d0b9ae146f9b695a3977959b0e014de6a312dad3f2fe30b6244f880706aee29
                                                                                                                                                                                        • Instruction ID: a303dc5a2cbce253aa0f80237919311aa16900bf4d9325e67d881a8b02039553
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1d0b9ae146f9b695a3977959b0e014de6a312dad3f2fe30b6244f880706aee29
                                                                                                                                                                                        • Instruction Fuzzy Hash: 33E012F11A260925FC1016187E16BD43A63FB9AB73F905957B7A0DC0D9DFD19451F014
                                                                                                                                                                                        Function 6F6F82BE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • srand.MSVCRT ref: 6F6F82DD
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(?,6F6FED33,?,6F70959C,?,6F6FEDAE,00000000), ref: 6F6F82EA
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SystemFunction036), ref: 6F6F82FA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleModuleProcsrand
                                                                                                                                                                                        • String ID: SystemFunction036
                                                                                                                                                                                        • API String ID: 2512791500-2669272182
                                                                                                                                                                                        • Opcode ID: 0d95492f98b99b8e3e4f3502d8b2032f14845cc976d3dacde8d17052355d3b09
                                                                                                                                                                                        • Instruction ID: aaf91abf7e93ee7fbe443009eceee5bfb83103414748b834cd510dfa264b402f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0d95492f98b99b8e3e4f3502d8b2032f14845cc976d3dacde8d17052355d3b09
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4BE092B160AA128BAB01AFB69E0855276E9BF6723530106BEE555E22E1EF309403C6D5
                                                                                                                                                                                        Function 6F6FE75F Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00000000,00000000), ref: 6F6FE76D
                                                                                                                                                                                        • memset.MSVCRT ref: 6F6FE797
                                                                                                                                                                                        • GetVersionExW.KERNEL32(?,?,?,76334C50), ref: 6F6FE7AC
                                                                                                                                                                                        • ShellExecuteW.SHELL32(?,?,00000000,?,00000000,00000001), ref: 6F6FE813
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AttributesExecuteFileShellVersionmemset
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2081363345-0
                                                                                                                                                                                        • Opcode ID: 76dba919366895d052aac1d8df3c4ce4bbeb9a09d062879c98b1adbe60f44a01
                                                                                                                                                                                        • Instruction ID: 964ac6db30d75ecac6130fae1e52bfb8ca0a6504ced11640e7edc36f78445c1f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 76dba919366895d052aac1d8df3c4ce4bbeb9a09d062879c98b1adbe60f44a01
                                                                                                                                                                                        • Instruction Fuzzy Hash: 46214CB1942218EBDB10DF94DD84BCDBBB9BF28310F1040A6E515A7280D730ABA1DBA1
                                                                                                                                                                                        Function 6F6FA6D4 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • memcpy.MSVCRT(?,00000000,?,?,00001000), ref: 6F6FA700
                                                                                                                                                                                        • memcpy.MSVCRT(?,00000000,00000000,?,00001000), ref: 6F6FA76C
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memcpy
                                                                                                                                                                                        • String ID: @$@
                                                                                                                                                                                        • API String ID: 3510742995-149943524
                                                                                                                                                                                        • Opcode ID: a36ba991c608406db8cffdd347e1d060245d3c2f916d169fcbcb4ea6cb3fd604
                                                                                                                                                                                        • Instruction ID: b296214a7bddcd2ce0743ab00af8e921f14f9a61cfddd9428e8aa21e9c488591
                                                                                                                                                                                        • Opcode Fuzzy Hash: a36ba991c608406db8cffdd347e1d060245d3c2f916d169fcbcb4ea6cb3fd604
                                                                                                                                                                                        • Instruction Fuzzy Hash: F0117C76901318EBDF048E68DC84ADA33BAFF04764F00852AFD198B185E775DA62CB90
                                                                                                                                                                                        Function 6F6F8E47 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • memcpy.MSVCRT(?,00000000,00000000,?,00001000,?,6F6F6EF7,?,?,?,6F6F718F), ref: 6F6F8E73
                                                                                                                                                                                        • memcpy.MSVCRT(00000000,00000000,00000000,?,00001000,?,6F6F6EF7,?,?,?,6F6F718F), ref: 6F6F8EDB
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memcpy
                                                                                                                                                                                        • String ID: @$@
                                                                                                                                                                                        • API String ID: 3510742995-149943524
                                                                                                                                                                                        • Opcode ID: f8b57ff5a7e8783ffda24da02ee1b389f4b53c6adf8c8f2f4e52eee1b8315496
                                                                                                                                                                                        • Instruction ID: ff42dd6b890ccf87c251fe58cf0da064c00bca4ea5d44e4899961925dd6d88d4
                                                                                                                                                                                        • Opcode Fuzzy Hash: f8b57ff5a7e8783ffda24da02ee1b389f4b53c6adf8c8f2f4e52eee1b8315496
                                                                                                                                                                                        • Instruction Fuzzy Hash: 59116072905318EBDF05CF29CC84ADA3766BF14764F0045AAFD1A4B291E371DA61CB84
                                                                                                                                                                                        Function 6F6F9153 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • memcpy.MSVCRT(00001000,6F6F6F07,?), ref: 6F6F917F
                                                                                                                                                                                        • memcpy.MSVCRT(?,6F6F6F07,00000000), ref: 6F6F91E7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: memcpy
                                                                                                                                                                                        • String ID: @$@
                                                                                                                                                                                        • API String ID: 3510742995-149943524
                                                                                                                                                                                        • Opcode ID: fd5d3abbb9c9639ec2fb595519174a39645128f9095b081f92212ad495bc6e5b
                                                                                                                                                                                        • Instruction ID: 23e12f288300093bc439cbe60b6e7cbf2a0dccb169f19c6bc6a8a0a0fd704927
                                                                                                                                                                                        • Opcode Fuzzy Hash: fd5d3abbb9c9639ec2fb595519174a39645128f9095b081f92212ad495bc6e5b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 48118171901308ABDB04DF25CC89A9A3766BF04768F00857AFD190B249E771EA55CB80
                                                                                                                                                                                        Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Close$Enum
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 464197530-0
                                                                                                                                                                                        • Opcode ID: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
                                                                                                                                                                                        • Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
                                                                                                                                                                                        • Opcode Fuzzy Hash: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
                                                                                                                                                                                        • Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68
                                                                                                                                                                                        Function 6F703560 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000000,6F700399,00000000,00000000,00000000), ref: 6F70357B
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,6F700399,00000000,00000000,00000000), ref: 6F703592
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,000000FF,00000000,00000000,00000000,6F700399,00000000,00000000,00000000), ref: 6F7035A6
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 6F7035C2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWide$??2@??3@
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 857525753-0
                                                                                                                                                                                        • Opcode ID: eb49f628872a1ce6b62edf71e6b913b27a41934f0d42b1d74d703779a996be94
                                                                                                                                                                                        • Instruction ID: 50ddc37784ad00394da03575899de692746d0c5f2e9603e169aaa93f24944137
                                                                                                                                                                                        • Opcode Fuzzy Hash: eb49f628872a1ce6b62edf71e6b913b27a41934f0d42b1d74d703779a996be94
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1101D1F22042192FEB5029385D86E7BA6CCEF9A2B9F11027AFA15D61E1DA419C040660
                                                                                                                                                                                        Function 6F7034F1 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,?,?,?,6F7001BF,00000000,00000000), ref: 6F70350F
                                                                                                                                                                                        • ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,?,?,?,6F7001BF,00000000,00000000,00000000), ref: 6F703518
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,?,6F7001BF,00000000,00000000,00000000), ref: 6F70352F
                                                                                                                                                                                        • ??3@YAXPAX@Z.MSVCRT(6F7001BF,?,?,?,6F7001BF,00000000,00000000,00000000), ref: 6F703551
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWide$??2@??3@
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 857525753-0
                                                                                                                                                                                        • Opcode ID: c5f5c8d0dc8502b9bec4c415ddb1682236d40b0e459ccef5be795f95163c95dd
                                                                                                                                                                                        • Instruction ID: 41d1d7410c0e1153f5762fe9c32ab8d883dad9864695ba1901c6bf3b13a677d0
                                                                                                                                                                                        • Opcode Fuzzy Hash: c5f5c8d0dc8502b9bec4c415ddb1682236d40b0e459ccef5be795f95163c95dd
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A01A2F2109259BFB6017E249DC4C7BB7DCEE962B9B21077AF470921E0CB20AC054A61
                                                                                                                                                                                        Function 6F70330C Relevance: 6.0, APIs: 4, Instructions: 48registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(6F709550,00000000,6F7033C9,00000000,?,?,6F702B75,00000000,00000000,?,?,?), ref: 6F703319
                                                                                                                                                                                        • RegisterClassW.USER32(?), ref: 6F703353
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(6F709550,?,?,6F702B75,00000000,00000000,?,?,?), ref: 6F70337E
                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(6F709550,?,?,6F702B75,00000000,00000000,?,?), ref: 6F703391
                                                                                                                                                                                          • Part of subcall function 6F6F591F: EnterCriticalSection.KERNEL32(6F709550,6F709550,?,?,?,6F6F78DB,6F6F77E1), ref: 6F6F592B
                                                                                                                                                                                          • Part of subcall function 6F6F591F: LeaveCriticalSection.KERNEL32(6F709550,?,?,?,6F6F78DB), ref: 6F6F595F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalSection$Leave$Enter$ClassRegister
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1868153721-0
                                                                                                                                                                                        • Opcode ID: 263bab287ab533cee6f695ea70acb448356a24864f9916f3c31eabd85d2f3ef5
                                                                                                                                                                                        • Instruction ID: 1fb4163a08db9a60d8a74c3eac804f2371c3e6475113c0e6a2ac08615cdc7eb6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 263bab287ab533cee6f695ea70acb448356a24864f9916f3c31eabd85d2f3ef5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4901D2B9914654AACF00AFB59605ADDB7F8BF5B314B0040AEE854B3281DF311202DB69
                                                                                                                                                                                        Function 6F6F59B1 Relevance: 6.0, APIs: 4, Instructions: 40windowsleepCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 6F6F59CD
                                                                                                                                                                                        • DispatchMessageW.USER32(?), ref: 6F6F59D7
                                                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 6F6F59E6
                                                                                                                                                                                        • Sleep.KERNEL32(00000000), ref: 6F6F59ED
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$Peek$DispatchSleep
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3374569338-0
                                                                                                                                                                                        • Opcode ID: 79dcde37a0e15db5c669cd765f061dc51332721e5e7ff215273156adc1dd0a98
                                                                                                                                                                                        • Instruction ID: a420f428f5246f9535a1e751e6cda7fe41f44b7f16afeb2af7f7d636c01ef165
                                                                                                                                                                                        • Opcode Fuzzy Hash: 79dcde37a0e15db5c669cd765f061dc51332721e5e7ff215273156adc1dd0a98
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8AF0A7729002597AEB10AAFA9C8CDDF3BBDEBC2B64B40402BBA11E2045DB54DC46C670
                                                                                                                                                                                        Function 6F6F59FE Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 6F6F5A01
                                                                                                                                                                                          • Part of subcall function 6F6F59B1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 6F6F59CD
                                                                                                                                                                                          • Part of subcall function 6F6F59B1: DispatchMessageW.USER32(?), ref: 6F6F59D7
                                                                                                                                                                                          • Part of subcall function 6F6F59B1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 6F6F59E6
                                                                                                                                                                                          • Part of subcall function 6F6F59B1: Sleep.KERNEL32(00000000), ref: 6F6F59ED
                                                                                                                                                                                        • MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,?,000005FF), ref: 6F6F5A27
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 6F6F5A35
                                                                                                                                                                                        • MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,?,000005FF), ref: 6F6F5A50
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$CountMultipleObjectsPeekTickWait$DispatchSleep
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 550391478-0
                                                                                                                                                                                        • Opcode ID: fb050e6bdc0203f43845014bc05cdd4e1ed919c827bd29be34598a6a2baac36b
                                                                                                                                                                                        • Instruction ID: 6a7b19d2e1991eafcfda6248fc68f893f98f7235fecbcf402f10b1ba2d217271
                                                                                                                                                                                        • Opcode Fuzzy Hash: fb050e6bdc0203f43845014bc05cdd4e1ed919c827bd29be34598a6a2baac36b
                                                                                                                                                                                        • Instruction Fuzzy Hash: A9F082B12425017FFA006A7C9DC4C3A769FEF55238B215939F950C7181EE258D236628
                                                                                                                                                                                        Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402EAA
                                                                                                                                                                                        • CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2102729457-0
                                                                                                                                                                                        • Opcode ID: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
                                                                                                                                                                                        • Instruction ID: 9c0cd9c85579b1f1539786df4f617efd254904ce91a486f6a135d178cfad0ab8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7AF05E30485630EBD6506B20FE0CACB7BA5FB84B41B0149BAF005B11E4D7B85880CBDC
                                                                                                                                                                                        Function 6F7016A7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _wsetlocale
                                                                                                                                                                                        • String ID: 0A$too_long
                                                                                                                                                                                        • API String ID: 756335651-3276959144
                                                                                                                                                                                        • Opcode ID: 9c93b8237cfb9ea47b9a71d3c600fc5bbb63dcd96f9d88d6323a3917c4cf3715
                                                                                                                                                                                        • Instruction ID: f2e76573b3c1a05ca5015d34ea597d387561dd0880b4ef69b1481d3644d102b8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c93b8237cfb9ea47b9a71d3c600fc5bbb63dcd96f9d88d6323a3917c4cf3715
                                                                                                                                                                                        • Instruction Fuzzy Hash: 51118EB62047018BDB15EF39CA51A0637F5AF9A228B05053EF516DB394DF709811C780
                                                                                                                                                                                        Function 6F70160D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _wsetlocale.MSVCRT ref: 6F701667
                                                                                                                                                                                          • Part of subcall function 6F7036D0: GlobalAlloc.KERNEL32(00000040,?,6F70959C,6F703818,?), ref: 6F7036E6
                                                                                                                                                                                          • Part of subcall function 6F7036D0: lstrcpynW.KERNEL32(00000004,?), ref: 6F7036FC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocGlobal_wsetlocalelstrcpyn
                                                                                                                                                                                        • String ID: 0A$error
                                                                                                                                                                                        • API String ID: 2697924176-3130266295
                                                                                                                                                                                        • Opcode ID: a7262b17c465ae747cd65e400e01e9eebd030ddc8a5e961cbbe392fdc754b1ab
                                                                                                                                                                                        • Instruction ID: 2e531e9b8f614b5d14918b9168427e4f794902d168df1d9d3aecc2dd3b7f224c
                                                                                                                                                                                        • Opcode Fuzzy Hash: a7262b17c465ae747cd65e400e01e9eebd030ddc8a5e961cbbe392fdc754b1ab
                                                                                                                                                                                        • Instruction Fuzzy Hash: E101C0F4208B028F9B00AF28CA10A423BEAAF9A238B0000BEF414D7380DF60D411CB91
                                                                                                                                                                                        Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                          • Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,75923420,004059EC,?,004DF000,75923420,00000000), ref: 00405C48
                                                                                                                                                                                          • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
                                                                                                                                                                                          • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65
                                                                                                                                                                                        • lstrlenW.KERNEL32(00464250,00000000,00464250,00464250,004DF000,?,75923420,004059EC,?,004DF000,75923420,00000000), ref: 00405CF0
                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00464250,00464250,00464250,00464250,00464250,00464250,00000000,00464250,00464250,004DF000,?,75923420,004059EC,?,004DF000,75923420), ref: 00405D00
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                        • String ID: PBF
                                                                                                                                                                                        • API String ID: 3248276644-3456974464
                                                                                                                                                                                        • Opcode ID: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
                                                                                                                                                                                        • Instruction ID: 4e01e145a0ed536ad24acc563e8a85444835dd946e40d448b56664b374cc0476
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 21F0F43500DF6125F626333A1C45AAF2555CE82328B6A057FFC62B12D2DA3C89539D7E
                                                                                                                                                                                        Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 004052C5
                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?), ref: 00405316
                                                                                                                                                                                          • Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3748168415-3916222277
                                                                                                                                                                                        • Opcode ID: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
                                                                                                                                                                                        • Instruction ID: 334c9fee3abb3f39d596823d3a3537c7effd0098edc8ca0b3d981ed7cb288a41
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
                                                                                                                                                                                        • Instruction Fuzzy Hash: F9015A31100709ABEB205F51DD94A9B3B26EB84795F20507AFA007A1D1D7BA9C919E2E
                                                                                                                                                                                        Function 6F6F6C2E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,The specified hash type is unknown/unsupported!,StdUtils::HashUtils,00040010), ref: 6F6F6C71
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • StdUtils::HashUtils, xrefs: 6F6F6C65
                                                                                                                                                                                        • The specified hash type is unknown/unsupported!, xrefs: 6F6F6C6A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message
                                                                                                                                                                                        • String ID: StdUtils::HashUtils$The specified hash type is unknown/unsupported!
                                                                                                                                                                                        • API String ID: 2030045667-651258368
                                                                                                                                                                                        • Opcode ID: 3be97a9c4da1713affecc6762835e03ae96e8a6b0a44add5742ac06491fb39bf
                                                                                                                                                                                        • Instruction ID: 88b241766f835ba0595a87b524ed9ed4b5bdcb90bb7ec2f6a0c08e8c5421a89c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3be97a9c4da1713affecc6762835e03ae96e8a6b0a44add5742ac06491fb39bf
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6CE012F228260874FA2015592C2AFC03222979AB33F648D82F390EC0D8CBE101A0B118
                                                                                                                                                                                        Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00468250,Error launching installer), ref: 004058CC
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 004058D9
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Error launching installer, xrefs: 004058B6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                        • String ID: Error launching installer
                                                                                                                                                                                        • API String ID: 3712363035-66219284
                                                                                                                                                                                        • Opcode ID: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
                                                                                                                                                                                        • Instruction ID: 30392a530fa928b09b8412afc6dc4f2cd20664ca8a9f97139eafb5a2ce14b88a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
                                                                                                                                                                                        • Instruction Fuzzy Hash: 33E09AB5540609BFEB009B64DD05F7B77ACEB04708F508565BD51F2150EB749C148A79
                                                                                                                                                                                        Function 6F9010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 6F90116A
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F9011C7
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 6F9011D9
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 6F901203
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2973369768.000000006F901000.00000020.00000001.01000000.00000007.sdmp, Offset: 6F900000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973329284.000000006F900000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973420626.000000006F904000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973476654.000000006F906000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f900000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$Free$Alloc
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1780285237-0
                                                                                                                                                                                        • Opcode ID: 5b30d414eefc5ccf20588462d1b200c80d76e6f32cdb9732ae139146ee1f11fd
                                                                                                                                                                                        • Instruction ID: 1f24a8ce6224de8dceafb671c5edb4c0b0f3f0fe8b1e573c3d177ef811ce9321
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b30d414eefc5ccf20588462d1b200c80d76e6f32cdb9732ae139146ee1f11fd
                                                                                                                                                                                        • Instruction Fuzzy Hash: F831A2B18042059BEB64AF7CC94496977F8FB57728700011EE944D72D0E734E8918F64
                                                                                                                                                                                        Function 6F6F77E1 Relevance: 5.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2972964114.000000006F6F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6F6F0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2972915418.000000006F6F0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973036436.000000006F704000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973069861.000000006F709000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2973117248.000000006F70A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_6f6f0000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalSectionfree$EnterLeave
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2088343094-0
                                                                                                                                                                                        • Opcode ID: fc4cd73e97ee468e6c2ce4aa7b409435f990c1a0c446640e24b497524e7761e7
                                                                                                                                                                                        • Instruction ID: 40868a0cfcdee02318941a5135d3f49f3c75247b13b141242658c8ac26344e95
                                                                                                                                                                                        • Opcode Fuzzy Hash: fc4cd73e97ee468e6c2ce4aa7b409435f990c1a0c446640e24b497524e7761e7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3101F7B1A156419BDF00CB6AD444B967BB9AFE6239F10007FE460E7381EA60E412D760
                                                                                                                                                                                        Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
                                                                                                                                                                                        • CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000C.00000002.2969656393.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969608056.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969706106.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000040A000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000412000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.000000000041E000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000448000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2969753612.0000000000469000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.0000000000597000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005AD000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000C.00000002.2970083094.00000000005B1000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_12_2_400000_NeatReader Setup 8.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                        • Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
                                                                                                                                                                                        • Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98